Splunk Search

Is there a standard procedure for updating lookup files in a Search Head Cluster?

Path Finder

Hi All,

I have read many posts in regards to updating lookup files in a Search Head Cluster, but those are dated to 2017. I want to know whether we have any standard procedure now as I am looking for the same.

My scenario is as below:

I have a Search Head Cluster and some Indexers clustered running on 7.1.3 and have built some custom apps with application data and enriching with lookup files. In order for the reports be up-to-date, I want to update these lookup files (daily). As number of lookup files are more (around 10, being used in different reports), manual update using Lookup Editor is not a good choice (at least for me).

So, I thought of writing a script to copy the lookup files from source server and update in Splunk app via CLI on each Search Head Cluster member at same time to ensure all are in sync.

Will this procedure create any syncing issues or issues while deploying from Deployer? Please guide me. Thanks in advance.

0 Karma


Load the csv as a normal lookup. Then look at doing an inputlookup of your csv followed by an outlook up to the kvstore lookup. Co sided append=true on the outputlookup if you don't want to wipe out existing data.


0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...