Deployment Architecture

creating a lookup with search-head pooling

a212830
Champion

Hi,

We just implemented search-head pooling. I have a lookup that gets generated via wget. How do people handle situations like this? I don't want to tie the scripts to a specific server, but I also want to make sure it runs when one of the servers is down. Is there a way to have Splunk run it, but not generate indexed data?

0 Karma

ewoo
Splunk Employee
Splunk Employee

One option: create a Python search command that updates your lookup. Then, schedule a search that invokes that search command on a desired interval (e.g. every night at midnight). The search heads in your pool will coordinate such that only one instance runs the scheduled search "at a time" (i.e. only one instance in the pool will run the scheduled search, per interval).

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...