Is it possible to replicate bash script generated lookup across search head cluster?

[milesmedboe]

Hi folks,

I am using a bash script to download data to populate a CSV that I'd like to use as a lookup in Splunk.

So far I have created the empty lookup on our deployer, which has successfully pushed it out to the search head cluster members.

I have a script running on the cluster-master that populates the empty lookup, the changes, however, are not replicating across the cluster, I expected this to work as the lookup location is whitelisted for replication in server.conf.

The changes to the CSV are failing to replicate across the cluster, do the changes to a lookup need to happen within Splunk for lookup replication to work?

An alternative solution would be to generate the script on the deployer and script a bundle push every 12 hours. I'm reluctant to have automated bundle pushes occurring outwith office hours due to issues we've experienced previously.

Has anyone ever attempted to do something similar, and is able to offer any guidance?

Many thanks,

Miles

[milesmedboe · Accepted solution]

Found a workaround here, implemented it and it is doing exactly what I wanted to do - https://medium.com/@clong/splunk-building-dynamic-lookup-tables-a593261569

Would be nice to see Splunk handling stuff like this better in future releases