topic Re: Where does config file goes for Automatic lookups in Getting Data In

Where does config file goes for Automatic lookups

rashi83 — Fri, 08 May 2020 04:35:27 GMT

Hi , I want to delete few Automatic lookups from server as it doesnt give me option of deleting it from GUI. Even though I have admin access to the env -

Can someone please guide

Re: Where does config file goes for Automatic lookups

vnravikumar — Fri, 08 May 2020 04:38:21 GMT

Check this, https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Makeyourlookupautomatic

Re: Where does config file goes for Automatic lookups

codebuilder — Fri, 08 May 2020 04:59:12 GMT

Delete the lookup file(s) from the SHC deployer and push out a new bundle.
That is the only way to delete them from a search head cluster, and is likely the reason you are not able to do so from the UI.

Re: Where does config file goes for Automatic lookups

rashi83 — Fri, 08 May 2020 12:37:49 GMT

Lookup has already been deleted . Issue is I cant delete the Automatic lookup definition.

Re: Where does config file goes for Automatic lookups

codebuilder — Fri, 08 May 2020 16:20:56 GMT

I'm guessing you have a dangling props.conf in a local folder somewhere (either system or user).
The deployer does not remove local files when you push a new bundle.

Use the following command to help find it:

/opt/splunk/splunk cmd btool props list --debug

Or use 'find' or 'locate' via CLI:

updatedb; locate props.conf
or
find /opt/splunk -name props.conf

Re: Where does config file goes for Automatic lookups

codebuilder — Fri, 08 May 2020 16:22:43 GMT

Delete the file, or the relevant stanzas, then cycle Splunk.

Re: Where does config file goes for Automatic lookups

rashi83 — Fri, 08 May 2020 16:54:16 GMT

this needs to be done on deployer or SH members?

Re: Where does config file goes for Automatic lookups

codebuilder — Fri, 08 May 2020 17:04:46 GMT

For local files you'll have to delete them manually on each search head.
But for clustered search heads, don't cycle Splunk manually, use the UI to cycle the cluster.

Re: Where does config file goes for Automatic lookups

rashi83 — Fri, 15 May 2020 03:33:24 GMT

@codebuilder - I am seeing those lookup defn in default folder on SH members. Is it safe to just delete them from all members or should I push new deployment from deployer?

Re: Where does config file goes for Automatic lookups

codebuilder — Fri, 15 May 2020 15:47:45 GMT

No, do not delete them manually if they are in the default folder on the search heads, only if you find them in a local directory.

If they are in the default dir only, then you'll need to push a new bundle from the deployer. Be sure to delete the files on the deployer in both default and local folders under your app/TA before pushing it out. Any files under local on the deployer are merged into default and pushed to the search heads there.