Splunk Search

Using Local=true in Automatic Lookups

Flynt
Splunk Employee
Splunk Employee

From my search flashtimeline I can tell my search head in a distributed environment to only use the local lookup file by adding local=true to my lookup statement. Is there a way to make automatic lookups only use the local lookup table that exists on my Search Head?

1 Solution

hexx
Splunk Employee
Splunk Employee

Looking at props.conf.spec and transforms.conf.spec, there doesn't seem to be a way to configure an automatic lookup to occur only locally on the search-head.

Time to file an enhancement request!

View solution in original post

hexx
Splunk Employee
Splunk Employee

Looking at props.conf.spec and transforms.conf.spec, there doesn't seem to be a way to configure an automatic lookup to occur only locally on the search-head.

Time to file an enhancement request!

View solution in original post

potnuru
Path Finder

Hi @hexx Is there a way to configure an automatic lookup to occur only locally on the search-head now?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!