Splunk Search

lookup access across non-clustered search heads

takashi6
Explorer

Hello experts and splunkers,

I have a splunk environment which consists of 2 Search Heads, which are not clustered - let's say SH1 and SH2, and 2 Indexers, which are clustered. (Please assume, due to an organisational reason, I can't cluster SH1 and SH2)

There is an existing app deployed in SH1 - let's say App1.

We are developing a new app in SH2 - let's say App2.

App1 has a lookup (let's say lookup1) and App2 in SH2 wants to use the lookup1.
I don't seem to be able to find a way to configure to enable App2 to access the lookup1.
Is it possible at all?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the lookup file is not on the local SH then no app can access it. You may want to set up a cron job to copy the lookup file between systems.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the lookup file is not on the local SH then no app can access it. You may want to set up a cron job to copy the lookup file between systems.

---
If this reply helps you, Karma would be appreciated.
0 Karma

takashi6
Explorer

Thank you, @richgalloway for your input. I understand.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...