topic Re: SH cluster, can't delete objects in Splunk Enterprise

SH cluster, can't delete objects

verbal_666 — Wed, 15 Mar 2017 08:34:45 GMT

We recently turned a single SH into a 3 SHs Cluster.

Now we cannot manager some object, since we have not the "move" or "delete" actions...

Example, in savedsearch.config, we have many alerts (66), many of them, with same permission, managed by Admin, have not the "move" and "delete" icon in Actions, others have them in Web UI.

Splunk 6.4.3 build b03109c2bad4

Bug? Need an update? Is there a fix?

Thanks.

Re: SH cluster, can't delete objects

verbal_666 — Wed, 15 Mar 2017 10:14:37 GMT

Here's the Web UI example, to see...

Re: SH cluster, can't delete objects

koshyk — Wed, 15 Mar 2017 11:01:27 GMT

it is not that simple to change a non-cluster SH to a cluster SH. Did you setup a deployer?
What i would do is to backup your configs, clean up all SH cluster members from scratch, set-it up and deploy from deployer using the backedup code.

Re: SH cluster, can't delete objects

verbal_666 — Wed, 15 Mar 2017 12:11:57 GMT

Yes. We have 1 DS inside and 2 Indexers.

So, there no "easy fix"? I really didn't want just to backup all .conf, maybe join them, and redistribute 😞

But if it's the only solution... we approach the problem so...

Thanks.

Re: SH cluster, can't delete objects

verbal_666 — Thu, 23 Mar 2017 11:49:19 GMT

I came now, with a "little" delay, in front of difference between Deployment & Deployer!!! 😐 😐 😐

So, we have a Deployment to distribuite apps to Forwarders. This is not the point.

And, YES, we have a Deployer to distribute apps to SHs, but still not working. So, the fact is here. Next step is to make the Deployer working.

Thanks. And sorry for the misunderstanding 🙂

Re: SH cluster, can't delete objects

skalliger — Wed, 19 Jul 2017 11:35:17 GMT

It's not a problem of the cluster, but of your config location. Your files are stored under default, am I correct?
You can only delete or move objects via the GUI when they're stored under local.

Skalli

Re: SH cluster, can't delete objects

verbal_666 — Wed, 19 Jul 2017 15:59:49 GMT

Need to verify it. Tomorrow i'll do. Maybe it's so! Tomorrow i'll verify and try a move of the objects with splunkd down. Thanks for now.

Re: SH cluster, can't delete objects

skalliger — Thu, 20 Jul 2017 11:15:47 GMT

You're welcome. I hope that was the problem, keep us updated.

Re: SH cluster, can't delete objects

verbal_666 — Thu, 20 Jul 2017 17:04:39 GMT

Had not time today to test. Also is a shared Environment, i can't shutdown processes as i want whenever i want 😉 i'll test it asap... the only thing i can say just now: we have surely many .conf divided in both default & local path; so i'll need also to merge them 😞 a big work... see asap... thanks