I have two search heads in cluster and multiple lookups in Splunk but currently started facing issues of replication of knowledge bundles. After investigation, I have observed that few of the lookups are not getting replicated between the search heads. I have learnt that it's best to use kv store than using lookups but I don't have clear idea of how and when using kv store is best suitable.
Would really appreciate your suggestions and help.
To use a kvstore lookup, you need to have already a collection in "collections.conf"
then you can create the lookup in transforms.conf.
The difference is that the list of fields has to be predefined.
To populate it you can use the API endpoints
or the first time you can populate it using kvstore methods, or use an outputlookup.
| inputlookup myoldcsvlookup | <do some clean up if necessary> | outputlookup mynewkvstorelookupcollection
then you can use the new lookup the same way you were doing.
In a SHcluster situation, it should replicate accros with the kvstore.
@MousumiChowdhury, following Splunk Dev site elucidates the steps required for
migrating from Lookups to KVStore.
Please try out and confirm.