Is there any way to post my local CSV file into Remote searchhead using REST call CURL user:password ?
As per my understanding, There is no such out of the box functionality to post csv file to remote search head.
Dynamic lookup update from remote
Workaround would be use KV Store lookup and REST API
to handle it. However you may need a script to handle the csv read and post the data. You have to create the kv-lookup file manually with fields to refer the collection.
Note: you can use "batch_save"
to post multiple records but the limitation is 1000 records per POST
You can create, read, update, delete, and manage KV Store data and collections using the Splunk REST API, which you access on the Splunk management port (the default port is 8089).
Sample:
curl -k -u admin:yourpassword -d name=kvstorecoll https://localhost:8089/servicesNS/nobody/search/storage/collections/config
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/config/kvstorecoll -d 'field.id=number' -d 'field.name=string' -d 'field.address=string' -d 'accelerated_fields.my_accel={"id": 1}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll -H 'Content-Type: application/json' -d '{"name": "Splunk HQ", "id": 123, "address": { "street": "250 Brannan Street", "city": "San Francisco", "state": "CA", "zip": "94107"}}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll/batch_save -H 'Content-Type: application/json' -d '[{"name": "Splunk Sweden"}, {"name": "Splunk Singapore"}]'
Link: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG
Hope this helps you!!!