What are the use cases where lookups are needed on the indexers/search-peers?

[pradeepkumarg]

I want to blacklist all the lookups from the replication bundle and would like to understand what are some valid use cases where you may need the lookups in the bundle reaching to search peers.

Thanks in advance!
Pradeep

[somesoni2]

i) The lookup is only needed on the Search Head when Lookup is done after aggregation. For example, in this scenario the lookup is only needed on the SH

index=foo | stats count by field1 | lookup somelookup field1 OUTPUT lookupfield

ii) Here's an example where the lookup is needed on the indexers (opposite of above scenario)

index=foo | lookup somelookup field1 OUTPUT lookupfield | stats count by lookupfield

iii) Lookup are used only for the Dashboard dropdown (selectiom), these lookup need not be send to the indexer.

iv) If the lookup is defined using props.conf (automatic lookups), these lookups are defined as Global and will be required on the indexers.

[my_lookuptype]
LOOKUP-foo = mylookuptable userid AS myuserid OUTPUT username AS myusername

[pradeepkumarg]

@somesoni2 For the scenario 2, I've blacklisted a lookup in distserach.conf not to be in the part of bundle and I was still successfully able to run the search using lookup command without any issues.

We have had issues with users creating large lookups and subsequently increasing the bundle size greatly which resulted in bundle replication errors and causing job delays for the schedule searches. I still don't understand a valid reason why lookups are needed on the indexers in the bundle other than auto lookups.

[pradeepkumarg]

Thanks for the response. For the second scenario, what if I use option local=true which forces to run on the search head ?