A customer with a large distributed environment has blacklisted a large lookup from the search bundle to decrease the bundle size using distsearch.conf. After this change, when running searches utilizing the lookup that was blacklisted they see error messages in the Splunk Search UI stating the lookup file does not exist. What can the customer do to resolve the issue?

Question

Accepted Answer

A. The search needs to be modified to ensure the lookup command specifies parameter local=true.

Answer

B. The blacklisted lookup definition stanza needs to be modified to specify setting

Answer

C. The search needs to be modified to ensure the lookup command specified parameter

Answer

D. The lookup cannot be blacklisted; the change must be reverted.

A customer with a large distributed environment has blacklisted a large lookup from the search bundle to decrease the bundle size using distsearch.conf. After this change, when running searches…

Question

Options

How the community answered

Explanation

Topics

Community Discussion