topic Re: Can an admin delete any lookup, owned by anybody? in Splunk Search

Can an admin delete any lookup, owned by anybody?

ddrillic — Wed, 13 Feb 2019 22:45:17 GMT

I'm trying, as an admin, to delete a couple of lookups, but I don't see a way to do it via the interface. Is there a way to do it? I'm not the owner of them ...

It's interesting that for some of them I see the Move | Delete options and for some not.

@somesoni2 referred to it at How to delete old lookup table (CSV) files in a search head clustering environment?

And we see this set -

None of them has the Delete action

Re: Can an admin delete any lookup, owned by anybody?

chrisyounger — Wed, 13 Feb 2019 23:40:55 GMT

If you have the appropriate permissions, there should be an option on the far right of that screenshot called "delete":

Re: Can an admin delete any lookup, owned by anybody?

ddrillic — Wed, 13 Feb 2019 23:43:15 GMT

Right, I see it for some and for some not...

Re: Can an admin delete any lookup, owned by anybody?

ddrillic — Thu, 14 Feb 2019 16:23:25 GMT

Our Sales Engineer said -

-- The ones you can’t delete directly are artifacts from prior to the migration to searchhead clustering. You’ll have to delete them through the API.

What would be the syntax?

Re: Can an admin delete any lookup, owned by anybody?

ddrillic — Thu, 14 Feb 2019 16:28:18 GMT

@somesoni2 said in the thread -

     curl -k -u admin:pass --request DELETE https://localhost:8089/servicesNS/admin/search/data/lookup-table-files/lookupToDelete.csv

Do I do it on one SH?

Re: Can an admin delete any lookup, owned by anybody?

chrisyounger — Thu, 14 Feb 2019 18:38:28 GMT

Yes it should replicate to the others

Re: Can an admin delete any lookup, owned by anybody?

chrisyounger — Thu, 14 Feb 2019 18:40:00 GMT

Also, you will need to remove the lookups from your search head deployer. Otherwise they will come back next time you do a bundle push.

Re: Can an admin delete any lookup, owned by anybody?

ddrillic — Sun, 17 Feb 2019 23:29:51 GMT

That's it - these lookups were pushed from the search head deployer. However, the UI doesn't allow us to know that these specific ones came from the deployer.

Re: Can an admin delete any lookup, owned by anybody?

ddrillic — Tue, 19 Feb 2019 21:05:42 GMT

Apparently, the ones from the deployer are immutable by design, as under the app directory, we only have the lookups directory and unlike other knowledge objects there are not under the local and default directories, which make them behave differently.