About luthfiag

luthfiag · ‎03-04-2014

I think the solution is using ssh modul in the python code so that the python script run only in the job server (by connecting ssh to job server first). I try that last night, there is some python modul I need to install first and I don't know why but it is so difficult 😐 . Maybe because the phyton version (i run Splunk 5.0.2) is older than the modul installer. Well because I'm not in a hurry and I have some other works I will try again later. I will inform if it is works. Thanks ayn and lukejadamec

luthfiag · ‎03-04-2014

So, How I can get the lookup from job server only ?

luthfiag · ‎03-04-2014

Here is my lookup phyton script : !/usr/bin/python import csv import sys def main(): try: csvfile = open( "/apps/splunk/etc/system/lookups/mycsv.csv", "rb" ) except Exception: sys.stderr.write("No file found.") sys.exit(0) dialect = csv.Sniffer().sniff( csvfile.read( 10*1024 ) ) csvfile.seek(0) reader = csv.reader( csvfile, dialect ) header = reader.next() data = [row for row in reader] writer = csv.writer( sys.stdout ) writer.writerow(header) [ writer.writerow(x) for x in data ] main()

luthfiag · ‎03-04-2014

Here is my search query : sourcetype=sourcetype-abc fieldinput=def | lookup dynamic-lookup fieldinput as fieldinput OUTPUTNEW fieldoutput as fieldoutput

luthfiag · ‎03-04-2014

Because when I run the search in search head (not the job server), the data comes from an indexer, lets say indexer A. And the command lookup after the search is only look for lookup in the indexer A. When I try to move my lookup to indexer A and not in job server, I'm facing a new problem, which is if my search data comes from indexer B, then the command lookup will only look for lookup in indexer B.

luthfiag · ‎03-04-2014

Hi Ayn, I'm not a Phyton coder, have little experience in programming and not a Splunk master, so it takes some time for me to try your trick. Here is my result and my condition : My condition : I have a few servers act as Search Head and one of them is a job server. I have some indexers. My Splunk's user access our Splunk from our Search Heads (except the job server) with load balancer in front of our search heads. What I want to do is locating the lookup in the job server. My result with your trick : I can not get the dynamic lookup from my job server.

luthfiag · ‎02-28-2014

Hi all, Can Splunk get data lookup from remote peer server ? The problem is, because we have many Splunk servers, so if the lookup is located to each servers, then when we want to manually update it, we have to update to all servers. What we want is to maintance the Splunk lookup table in one server and all other servers get data from that server. I try this query but it is not working * | head 1 | eval fieldinput="abc" | lookup local=false lookup-table-a fieldinput AS fieldinput OUTPUTNEW fieldoutput AS fieldoutput The error is Error in 'lookup' command: The lookup table 'lookup-table-a' does not exist. Well lookup-table-a is located in server a. I have the query in server b which the search peer to server a is enabled. So, Can Splunk get data lookup from remote peer server ?

Posts	7
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎10-11-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How get data lookup from other remote peer?

Re: Get Data lookup from Other Remote Peer

Re: Get Data lookup from Other Remote Peer

Re: Get Data lookup from Other Remote Peer

Re: Get Data lookup from Other Remote Peer

Re: Get Data lookup from Other Remote Peer

Re: Get Data lookup from Other Remote Peer

How get data lookup from other remote peer?