https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200245#M1045 <P>I know in version 4.1.0 assets get merged into two files. You can search both of those using the following:</P> <P>|inputlookup append=T asset_lookup_by_str | inputlookup append=t asset_lookup_by_cidr_raw</P> <P>This will confirm if your demo assets are still in the merged file. I would recommend backing up the file first, but you could empty this file and it would rebuild upon next merge. </P> <P>I know a similar set of files (possibly the same ones) exists in earlier versions of ES. </P> <P>Ryan</P> Tue, 29 Sep 2020 10:26:10 GMT ryanoconnor 2020-09-29T10:26:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200241#M1041 <P>I've configured my own asset list, and now I want to stop asset information from the "demo assets" lookup from showing up in Dashboards, searches, etc. I've disabled the asset in the ES configuration, but it hasn't had any effect. How can I get rid of this junk data?</P> Fri, 29 Jul 2016 10:35:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200241#M1041 khagan 2016-07-29T10:35:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200242#M1042 <P>Have you tried disabling the demo assets and waiting for the merge process to run? </P> <P><A href="http://docs.splunk.com/Documentation/ES/4.2.0/User/Identitymanagement#Verify_the_merging_process">http://docs.splunk.com/Documentation/ES/4.2.0/User/Identitymanagement#Verify_the_merging_process</A></P> Fri, 29 Jul 2016 11:44:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200242#M1042 ryanoconnor 2016-07-29T11:44:15Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200243#M1043 <P>Yes, as mentioned I've disabled the demo assets. I've also forced the merge, and nothing has happened.</P> Fri, 29 Jul 2016 11:45:47 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200243#M1043 khagan 2016-07-29T11:45:47Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200244#M1044 <P>What version of ES are you running? </P> Fri, 29 Jul 2016 11:54:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200244#M1044 ryanoconnor 2016-07-29T11:54:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200245#M1045 <P>I know in version 4.1.0 assets get merged into two files. You can search both of those using the following:</P> <P>|inputlookup append=T asset_lookup_by_str | inputlookup append=t asset_lookup_by_cidr_raw</P> <P>This will confirm if your demo assets are still in the merged file. I would recommend backing up the file first, but you could empty this file and it would rebuild upon next merge. </P> <P>I know a similar set of files (possibly the same ones) exists in earlier versions of ES. </P> <P>Ryan</P> Tue, 29 Sep 2020 10:26:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200245#M1045 ryanoconnor 2020-09-29T10:26:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200246#M1046 <P>I aggree with rynoconnor's second answer. </P> <P>The asset and identities are in a lookup file. Whatever new lookups are added as identity or asset, ES will merged data into the existing lookup file rather than overwriting. </P> <P>For this purpose, if you want to remove demo assets, you should empty asset_lookup_by_str.csv and asset_lookup_by_cidr.csv files. These files can be found in SA-IdentityManagement/lookups folder.</P> Tue, 29 Sep 2020 10:25:25 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200246#M1046 hardikJsheth 2020-09-29T10:25:25Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200247#M1047 <P>So this worked, but now my own asset lists aren't merging back in - the files are just empty. I've tried to force the merge:<BR /> <EM>$SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config identity_manager | $SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/SA-IdentityManagement/bin/identity_manager.py --username=admin</EM></P> <P>Still when I search for assets, it now returns 0 results. Am I missing a step?</P> Tue, 29 Sep 2020 10:26:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200247#M1047 khagan 2020-09-29T10:26:16Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200248#M1048 <P>Do you have empty file ? Keep the files with header lines.</P> Fri, 29 Jul 2016 16:28:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200248#M1048 hardikJsheth 2016-07-29T16:28:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200249#M1049 <P>The file still has the headers:<BR /> key,asset_id,asset_tag,bunit,category,city,country,dns,ip,is_expected,lat,long,mac,nt_host,owner,pci_domain,priority,requires_av,should_timesync,should_update</P> Tue, 29 Sep 2020 10:26:25 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-remove-asset-data/m-p/200249#M1049 khagan 2020-09-29T10:26:25Z