Splunk Search

Selective Replication of Lookups between Search Heads?

mlorrette
Path Finder

I have two search heads in a cluster. SH-A is locked down and is only used by certain staff. SH-B is open to others. SH-A updates a lookup table several times a day, triggered by search results and not based on a schedule. How can I replicate only this lookup table to SH-B? I don't want to replicate any other search app data.

I've tried using the REST API to simply upload the lookup table from SH-A to SH-B using a script but looks like this is impossible.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

HI @mlorrette

I assume you mean the servers are unclustered, otherwise they would already be sharing lookups and authentication configuration..

In any case, it IS possible to sync a lookup between search heads. Please read this article: https://www.splunk.com/blog/2017/06/08/syncing-lookups-using-pure-spl.html

All the best! Chris.

0 Karma

mlorrette
Path Finder

@chrisyoungerjds - the article requires that you add SH-A, the locked-down server, as a search peer to SH-B. This opens up the entire search head to SH-B. Per the post:

"How can I replicate only this lookup table to SH-B? I don't want to replicate any other search app data."

Also- I was interested in pushing the lookup from SH-A to SH-B upon changes (using a script for example). The article uses a scheduled search in SH-B to sync the SH-A lookup table, say every 10 minutes. This isn't efficient as

"SH-A updates a lookup table several times a day, triggered by search results and not based on a schedule".

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Fair enough. Well I guess your best option would be to write a small modular input or script external to splunk that constantly checks the lookup file and does a scp to server-B if has changed. Should be pretty simple.

0 Karma

mlorrette
Path Finder

Do you know if there is a way to trigger a refresh of the lookup file from a script or the REST API, without refreshing the entire environment (i.e. debug->refresh)? seems inefficient to constantly check the lookup file for changes.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

You don't need to do a debug refresh when a lookup file changes.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...