Splunk Search

lookup access across non-clustered search heads

takashi6
Explorer

Hello experts and splunkers,

I have a splunk environment which consists of 2 Search Heads, which are not clustered - let's say SH1 and SH2, and 2 Indexers, which are clustered. (Please assume, due to an organisational reason, I can't cluster SH1 and SH2)

There is an existing app deployed in SH1 - let's say App1.

We are developing a new app in SH2 - let's say App2.

App1 has a lookup (let's say lookup1) and App2 in SH2 wants to use the lookup1.
I don't seem to be able to find a way to configure to enable App2 to access the lookup1.
Is it possible at all?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the lookup file is not on the local SH then no app can access it. You may want to set up a cron job to copy the lookup file between systems.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the lookup file is not on the local SH then no app can access it. You may want to set up a cron job to copy the lookup file between systems.

---
If this reply helps you, Karma would be appreciated.
0 Karma

takashi6
Explorer

Thank you, @richgalloway for your input. I understand.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...