Project

General

Profile

Task #2193

Determine if updated SHC rules could synchronize the lookup backups

Added by Luke Murphey over 6 years ago. Updated about 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Luke Murphey
Target version:
3.0
Start date:
01/29/2018
Due date:
% Done:

100%

Description

Something like:

/opt/splunk/bin/splunk btool server list --debug shcluster | grep lookup
/opt/splunk/etc/system/default/server.conf conf_replication_include.lookups = true
/opt/splunk/etc/system/default/server.conf conf_replication_summary.blacklist.lookup_index = (system|(apps/*)|users(/_reserved)?/*/*)/lookups/*.(tmp$|index($|/...))
/opt/splunk/etc/system/default/server.conf conf_replication_summary.whitelist.lookups = (system|(apps/*)|users(/_reserved)?/*/*)/lookups/*

History

#2 Updated by Luke Murphey over 6 years ago

  • Status changed from New to Rejected

#3 Updated by Luke Murphey about 6 years ago

  • Status changed from Rejected to New

#4 Updated by Luke Murphey about 6 years ago 

/opt/splunk/etc/system/default/server.conf conf_replication_include.lookups = true
/opt/splunk/etc/system/default/server.conf conf_replication_summary.blacklist.lookup_index = (system|(apps/*)|users(/_reserved)?/*/*)/lookups/*.(tmp$|index($|/...))
/opt/splunk/etc/system/default/server.conf conf_replication_summary.whitelist.lookups = (system|(apps/*)|users(/_reserved)?/*/*)/lookups/*|apps/*/lookups/lookup_file_backups/*/*/*/*.csv

#7 Updated by Luke Murphey about 6 years ago

Tried, but the file isn't replicating. I see the directory on:

/opt/splunk/etc/apps/lookup_editor/lookups/lookup_file_backups/lookup_editor/nobody

#8 Updated by Luke Murphey about 6 years ago

I will need to move the lookup backups to another directory if I go with this approach since the blacklist won't allow sub-directories in the lookup directory.

#9 Updated by Luke Murphey about 6 years ago

  • Status changed from New to In Progress

#10 Updated by Luke Murphey about 6 years ago

  • Status changed from In Progress to Closed
  • % Done changed from 0 to 100

Confirmed from Core: "the short version is: you can't include arbitrary files in member-to-member replication"

Also available in: Atom PDF