Splunk Search

What are the use cases where lookups are needed on the indexers/search-peers?

pradeepkumarg
Influencer

I want to blacklist all the lookups from the replication bundle and would like to understand what are some valid use cases where you may need the lookups in the bundle reaching to search peers.

Thanks in advance!
Pradeep

0 Karma

somesoni2
Revered Legend

i) The lookup is only needed on the Search Head when Lookup is done after aggregation. For example, in this scenario the lookup is only needed on the SH

index=foo | stats count by field1 | lookup somelookup field1 OUTPUT lookupfield

ii) Here's an example where the lookup is needed on the indexers (opposite of above scenario)

index=foo | lookup somelookup field1 OUTPUT lookupfield | stats count by lookupfield

iii) Lookup are used only for the Dashboard dropdown (selectiom), these lookup need not be send to the indexer.

iv) If the lookup is defined using props.conf (automatic lookups), these lookups are defined as Global and will be required on the indexers.

[my_lookuptype]
LOOKUP-foo = mylookuptable userid AS myuserid OUTPUT username AS myusername

pradeepkumarg
Influencer

@somesoni2 For the scenario 2, I've blacklisted a lookup in distserach.conf not to be in the part of bundle and I was still successfully able to run the search using lookup command without any issues.

We have had issues with users creating large lookups and subsequently increasing the bundle size greatly which resulted in bundle replication errors and causing job delays for the schedule searches. I still don't understand a valid reason why lookups are needed on the indexers in the bundle other than auto lookups.

0 Karma

pradeepkumarg
Influencer

Thanks for the response. For the second scenario, what if I use option local=true which forces to run on the search head ?

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...