Hi,
We are in process of migrating On-Premise Apps to Splunk Cloud.
There is one App in which few scripts are there which (by accessing local directory) updates the lookup files continuously to be used on Searchhead.
For this EITHER we can place the scripts on Local Universal Forwarders, where it will update the lookup files locally (by accessing cifs mounts) and then need to check if there's any mechanism by which these lookups file can be forwarded continuously to Splunk Cloud Searchhead from local forwarder OR the scripts to be placed directly on Cloud Searchhead.
Out of this the 2nd option won't work as scripts can't be placed over Cloud Searchhead as it access/needs the local filers (cifs) mount points to update the lookup file data.
So need to know if there is any mechanism by which the updated lookups file can be forwarded continuously from local Universal Forwarders to Splunk Cloud Searchhead?
Thanks
↧
