Is there a way to make automatic lookups only use the local lookup table that exists on my search head?

[Flynt]

From my search flashtimeline I can tell my search head in a distributed environment to only use the local lookup file by adding local=true to my lookup statement. Is there a way to make automatic lookups only use the local lookup table that exists on my Search Head?

[elewis1]

I know this is old, but it's the first Google result.

A workaround is Calculated fields can use |eval lookup(). The lookup must be a .csv file on the search head(s).

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions

[nunoaragao]

To @potnuru  and others that might fall here .. there is a setting on transforms.conf called replicate to: 

Indicates whether to replicate CSV lookups to indexers

[rquish]

This is the solution I was looking for. The lookup definition UI does not have the option to keep it local like the SPL does. This is effectively making the lookup local wherever/whenever called.

Thanks for insight... better late than never 🙂

[hexx · Accepted solution]

Looking at props.conf.spec and transforms.conf.spec, there doesn't seem to be a way to configure an automatic lookup to occur only locally on the search-head.

Time to file an enhancement request!

[potnuru]

Hi @hexx Is there a way to configure an automatic lookup to occur only locally on the search-head now?