FAQ » History » Version 3
Version 2 (Luke Murphey, 06/10/2015 05:30 PM) → Version 3/7 (Luke Murphey, 04/26/2018 07:28 PM)
h1. FAQ
h2. How do I audit changes to the lookup files?
The lookup editor keeps a log that is indexed into the _internal index. You can view that logs like this:
<pre>
index=_internal "Lookup edited successfully" | table _time user namespace lookup_file
</pre>
h2. My lookup file cannot be opened, why not?
Look into the logs to see if there is a reason given why the files are not loading:
<pre>
index=_internal source=*lookup_editor_controller.log
</pre>
h2. How do I enable replicating of the lookup file backups to other search heads when using a Search Head Cluster?
You can enable replication of the lookup backups by using the REST replay feature. To enable this, add the following in restmap.conf (in $SPLUNK_HOME/etc/shcluster/lookup_editor/default/restmap.conf):
<pre>
[global]
allowRestReplay = true
</pre>
This will work on Splunk 6 from (6.3+) and on Splunk 7.1+. +*However, do not enable*+ this on Splunk 7.0 (7.0 to 7.0.3) because there is a bug in Splunk 7.0 that causes REST replay to crash splunkd.
h2. How do I audit changes to the lookup files?
The lookup editor keeps a log that is indexed into the _internal index. You can view that logs like this:
<pre>
index=_internal "Lookup edited successfully" | table _time user namespace lookup_file
</pre>
h2. My lookup file cannot be opened, why not?
Look into the logs to see if there is a reason given why the files are not loading:
<pre>
index=_internal source=*lookup_editor_controller.log
</pre>
h2. How do I enable replicating of the lookup file backups to other search heads when using a Search Head Cluster?
You can enable replication of the lookup backups by using the REST replay feature. To enable this, add the following in restmap.conf (in $SPLUNK_HOME/etc/shcluster/lookup_editor/default/restmap.conf):
<pre>
[global]
allowRestReplay = true
</pre>
This will work on Splunk 6 from (6.3+) and on Splunk 7.1+. +*However, do not enable*+ this on Splunk 7.0 (7.0 to 7.0.3) because there is a bug in Splunk 7.0 that causes REST replay to crash splunkd.