Agree with @changux, if you can find a way to periodically move the csv to the local server in an automated fashion, that would make life easier. I had a very similar issue where I had a powershell script, which ran daily, creating a csv file on a windows server which was also configured as a heavy forwarder. Splunk monitored the output folder and read in each new file to send to one of the index servers. The search head then performed a scheduled search and created a new local lookup file using outputcsv. This turned out to be inconsistent. Far simpler to have the powershell script save the output directly to the search head lookup folder (multiple ways to do this). ... View more

If they were all private objects, you might find those inside $SPLUNK_HOME/etc/users/<USERNAME>/<APPNAME>/local For example, I have a private dashboard at: /apps/splunk/etc/users/admin/search/local/data/ui/views/dev__printing.xml Hope that helps. Cheers ... View more