Is there a standard procedure for updating lookup files in a Search Head Cluster?

[siva_cg]

Hi All,

I have read many posts in regards to updating lookup files in a Search Head Cluster, but those are dated to 2017. I want to know whether we have any standard procedure now as I am looking for the same.

My scenario is as below:

I have a Search Head Cluster and some Indexers clustered running on 7.1.3 and have built some custom apps with application data and enriching with lookup files. In order for the reports be up-to-date, I want to update these lookup files (daily). As number of lookup files are more (around 10, being used in different reports), manual update using Lookup Editor is not a good choice (at least for me).

So, I thought of writing a script to copy the lookup files from source server and update in Splunk app via CLI on each Search Head Cluster member at same time to ensure all are in sync.

Will this procedure create any syncing issues or issues while deploying from Deployer? Please guide me. Thanks in advance.

[muralikoppula]

Load the csv as a normal lookup. Then look at doing an inputlookup of your csv followed by an outlook up to the kvstore lookup. Co sided append=true on the outputlookup if you don't want to wipe out existing data.

https://github.com/georgestarcher/Splunk-createkvstore/blob/master/makekvstore.py