As per my understanding, There is no such out of the box functionality to post csv file to remote search head.
Dynamic lookup update from remote Workaround would be use KV Store lookup and REST API to handle it. However you may need a script to handle the csv read and post the data. You have to create the kv-lookup file manually with fields to refer the collection.
Note: you can use "batch_save" to post multiple records but the limitation is 1000 records per POST
You can create, read, update, delete, and manage KV Store data and collections using the Splunk REST API, which you access on the Splunk management port (the default port is 8089).
Sample:
curl -k -u admin:yourpassword -d name=kvstorecoll https://localhost:8089/servicesNS/nobody/search/storage/collections/config
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/config/kvstorecoll -d 'field.id=number' -d 'field.name=string' -d 'field.address=string' -d 'accelerated_fields.my_accel={"id": 1}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll -H 'Content-Type: application/json' -d '{"name": "Splunk HQ", "id": 123, "address": { "street": "250 Brannan Street", "city": "San Francisco", "state": "CA", "zip": "94107"}}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll/batch_save -H 'Content-Type: application/json' -d '[{"name": "Splunk Sweden"}, {"name": "Splunk Singapore"}]'
Link: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG
Hope this helps you!!!
V
