i) The lookup is only needed on the Search Head when Lookup is done after aggregation. For example, in this scenario the lookup is only needed on the SH
index=foo | stats count by field1 | lookup somelookup field1 OUTPUT lookupfield
ii) Here's an example where the lookup is needed on the indexers (opposite of above scenario)
index=foo | lookup somelookup field1 OUTPUT lookupfield | stats count by lookupfield
iii) Lookup are used only for the Dashboard dropdown (selectiom), these lookup need not be send to the indexer.
iv) If the lookup is defined using props.conf (automatic lookups), these lookups are defined as Global and will be required on the indexers.
LOOKUP-foo = mylookuptable userid AS myuserid OUTPUT username AS myusername
Thanks for the response. For the second scenario, what if I use option local=true which forces to run on the search head ?
@somesoni2 For the scenario 2, I've blacklisted a lookup in distserach.conf not to be in the part of bundle and I was still successfully able to run the search using lookup command without any issues.
We have had issues with users creating large lookups and subsequently increasing the bundle size greatly which resulted in bundle replication errors and causing job delays for the schedule searches. I still don't understand a valid reason why lookups are needed on the indexers in the bundle other than auto lookups.