【重要】Splunk 的 Lookup Table能否被覆盖呢？

shenghuiping2001

于 2023-11-26 13:21:53 发布

阅读量1.1k

点赞数 22

分类专栏： splunk 文章标签： Splunk app.conf lookup table overwrite 覆盖

本文链接：https://blog.csdn.net/shenghuiping2001/article/details/134626548

版权

splunk 专栏收录该内容

204 篇文章 15 订阅 ¥39.90 ¥99.00

订阅专栏

超级会员免费看

1: 背景：

用户自己的lookup table 可能需要被覆盖，因为用户自己会自动更新，但是如果不是用户自己更新，Deployer 上面发布的时候，用于没有用户的table ，那么默认是不能把客户的table overwite 的。如果用户要覆盖的话，如果客户有权限的话，客户可以自己更换lookup table.

2: 原理：

Preserve lookup files across app upgrades

Any app that uses lookup tables typically ships with stubs for the table files. Once the app is in use on the search head the tables get populated by runtime processes, such as searches. When you later upgrade the app, you can choose to preserve the populated lookup tables or overwrite them with stubs.

Set the deployer_lookups_push_mode in app.conf to specify how the deployer handles lookup tables when upgrading apps. This setting determines the behavior of the -preserve-lookups option when you push the configuration bundle using the splunk apply shcluster-bundle command.