Lookups in a distributed search environment

[pgissiner]

I have configured a field lookup on our test server to return a readable name for event codes in our logs. Doing so with a TA app, so I have a folder with the proper subfolders containing my confs, the csv for the lookup, and local/default.meta. This works just fine in our test environment, and places a field in the left sidebar that displays the readable names in the logs returned while searching.

We decided to move this to production, and have not had success. Our production environment has two indexers, two search heads serving different purposes, and an app deployment server. When we deployed the TA to our production environment to the search head we use to query splunk we originally encountered errors in the props, and transforms.conf that needed to be fixed. Having done that the errors cleared, yet we do not get a field containing readable names for the event codes in our logs. Are there any differences between a 'monolithic' and distributed search environment that would prevent a lookup from one working on the other?

[asimagu]

No, it should work as long as you deploy the config to the right place. You have two options, deploy the config to the indexers or to the forwarders (depending if these are Universal, light or heavy forwarders...). The best option would be to have this deployed to the indexers.

In this kind of distributed environments I always deploy an app called globalconfig to the indexers with all the automatic field extractions/lookups that I need. Also make sure that this settings have the rights permissions in order to work 😉