Splunk Search

lookup access across non-clustered search heads

takashi6
Explorer

Hello experts and splunkers,

I have a splunk environment which consists of 2 Search Heads, which are not clustered - let's say SH1 and SH2, and 2 Indexers, which are clustered. (Please assume, due to an organisational reason, I can't cluster SH1 and SH2)

There is an existing app deployed in SH1 - let's say App1.

We are developing a new app in SH2 - let's say App2.

App1 has a lookup (let's say lookup1) and App2 in SH2 wants to use the lookup1.
I don't seem to be able to find a way to configure to enable App2 to access the lookup1.
Is it possible at all?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the lookup file is not on the local SH then no app can access it. You may want to set up a cron job to copy the lookup file between systems.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the lookup file is not on the local SH then no app can access it. You may want to set up a cron job to copy the lookup file between systems.

---
If this reply helps you, Karma would be appreciated.
0 Karma

takashi6
Explorer

Thank you, @richgalloway for your input. I understand.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...