Splunk Search

How to write lookup app file to update to correct location with distributed searches?

robertlabrie
Path Finder

I've written a lookup app called TA-browscap_lookup_express. It needs to write data out to a CSV to be re-used on future searches. When I had everything on a single machine, it worked fine, but now that I've gone to a distributed setup, I've noticed that the app runs on the indexer, not the search head, and that it runs in $SPLUNK_HOME/var/run/searchpeers/mypeer-somecode/apps\TA-browscap_express/bin. "somecode" gets regenerated, so basically the whole point of speeding up browscap lookups with a cache is lost because the cache is written to a different location on every run. I'm obviously doing something wrong, so my question is: what's the right way to write this file so that it is updated and persists between searches?

Thanks,
Rob

0 Karma
1 Solution

robertlabrie
Path Finder

In the end I decided to make the file location configurable, and configured it to be a CIFS share. This solved the problem with the least amount of work. Writing data back to splunk through the API would have been cooler, but much more work.

View solution in original post

0 Karma

robertlabrie
Path Finder

In the end I decided to make the file location configurable, and configured it to be a CIFS share. This solved the problem with the least amount of work. Writing data back to splunk through the API would have been cooler, but much more work.

0 Karma

robertlabrie
Path Finder

Hi Martin, thanks for your reply. I thought about this, either extracting the TEMP env var or making it configurable pointing to some CIFS/NFS share, which is still on the table. I'm hoping there is a splunk-centric way of doing this (like maybe I can use the API and store the matches in an index). Worst case I'll drop an ini file in the app and for distributed setups let people use a share.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

A generic idea would be to create a directory such as /tmp/splunk/TA-browscap_express and use that.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...