lookup access across non-clustered search heads

[takashi6]

Hello experts and splunkers,

I have a splunk environment which consists of 2 Search Heads, which are not clustered - let's say SH1 and SH2, and 2 Indexers, which are clustered. (Please assume, due to an organisational reason, I can't cluster SH1 and SH2)

There is an existing app deployed in SH1 - let's say App1.

We are developing a new app in SH2 - let's say App2.

App1 has a lookup (let's say lookup1) and App2 in SH2 wants to use the lookup1.
I don't seem to be able to find a way to configure to enable App2 to access the lookup1.
Is it possible at all?

[richgalloway · Accepted solution]

If the lookup file is not on the local SH then no app can access it. You may want to set up a cron job to copy the lookup file between systems.

[takashi6]

Thank you, @richgalloway for your input. I understand.