Splunk Search

lookup access across non-clustered search heads

takashi6
Explorer

Hello experts and splunkers,

I have a splunk environment which consists of 2 Search Heads, which are not clustered - let's say SH1 and SH2, and 2 Indexers, which are clustered. (Please assume, due to an organisational reason, I can't cluster SH1 and SH2)

There is an existing app deployed in SH1 - let's say App1.

We are developing a new app in SH2 - let's say App2.

App1 has a lookup (let's say lookup1) and App2 in SH2 wants to use the lookup1.
I don't seem to be able to find a way to configure to enable App2 to access the lookup1.
Is it possible at all?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the lookup file is not on the local SH then no app can access it. You may want to set up a cron job to copy the lookup file between systems.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the lookup file is not on the local SH then no app can access it. You may want to set up a cron job to copy the lookup file between systems.

---
If this reply helps you, Karma would be appreciated.
0 Karma

takashi6
Explorer

Thank you, @richgalloway for your input. I understand.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...