Splunk Search

I need to get a kvstore lookup from my ES search head to another search head... REST API in SPL?


I am creating a dashboard that unfortunately badly needs a kvstore lookup that lives on the ES search head. I know I can run REST calls across instances, but can I call the data in this kvstore on ES from my (non ES) search head and use it in a lookup? Of at least OUTPUTLOOKUP it?


I would imagine issues with app permissions etc... Any help is much appreciated. I can think of more clunky ways to do it but this one seems too elegant to ignore 🙂


Labels (2)
0 Karma