Hi,
I have clustered environment (Search Head Cluster with 3 SHs working with an Indexer Cluster with 2 IDXs) and I have created a KV Store lookup on the Search Head and set replicated = true .
Now I am trying to use that same KV Store (which I hope would be replicated to the Indexer) to use as lookup on the Indexer, however, it doesn't seem to be working. I have tried |inputlookup , but no result.
Could someone tell me the proper way of doing this? and how to check that KV Store is replicated properly from Search Head to Indexer? And also want to check to see if KV Store is replicated within the Search Head Cluster.
Thank you.
--Edited---
Concerning this issue, I tried packet capturing between search head and indexer server, but could not see any communications other than 8089. As it says here http://docs.splunk.com/Documentation/Splunk/latest/Admin/Collectionsconf if I set replicate = true , it will be replicated to the indexers, but doesn't seem to be working. Also, I can not find any other documents regarding this nor any helpful answer posts.
Please, if anyone knows or has done this before, teach me how!
... View more