topic Re: What's ops.json in etc/system/replication? in Splunk Search

What's ops.json in etc/system/replication?

tfechner — Tue, 11 Jun 2019 07:50:56 GMT

Hi,

we removed some roles and checked on file level where these roles still have a reference.
We found the file splunk/etc/system/replication/ops.json still hase a reference to the deleted roles.

We use SH-Cluster and idx-cluster.

Who has informations about this file?

Torsten

Re: What's ops.json in etc/system/replication?

harsmarvania57 — Tue, 11 Jun 2019 08:31:46 GMT

Hi,

How you removed the roles from Splunk Search Head Cluster ? If you modified authorize.conf and authentication.conf directly on SHC members then please do rolling restart of all SHC members.

Re: What's ops.json in etc/system/replication?

tfechner — Tue, 11 Jun 2019 09:17:38 GMT

we removed the roles in the SH-cluster via the GUI. but some relicts are still in the config files, esp. local.meta

Re: What's ops.json in etc/system/replication?

harsmarvania57 — Tue, 11 Jun 2019 09:46:26 GMT

When you remove role from Search Head and if that role is used for read and write permission for knowledge objects then splunk will not remove it and knowledge objects permissions are in local.meta , you need to manually remove those.

Re: What's ops.json in etc/system/replication?

tfechner — Tue, 11 Jun 2019 10:36:10 GMT

done. grep and xargs are your friend.
but still the question: what's done with ops.json

Re: What's ops.json in etc/system/replication?

harsmarvania57 — Tue, 11 Jun 2019 10:57:55 GMT

That file contains all files and config for Search Head Cluster state. For example {"dst":["nobody","system","authorize","role_ABC"] , this will indicate that you have role_ABC in $SPLUNK_HOME/etc/system and config in authorize.conf config file.

Please check whether all SHC members are in sync or not. If all SHC members are in sync then check configuration file for those roles which are reflecting in ops.json

Re: What's ops.json in etc/system/replication?

tfechner — Wed, 30 Sep 2020 00:52:41 GMT

all members are in sync. mostly the location "$SPLUNK_HOME/var/run/splunk/lookup_tmp/" is the problem . this path is empty!

Re: What's ops.json in etc/system/replication?

nnmiller — Tue, 25 Jun 2019 19:02:57 GMT

splunk/etc/system/replication/ops.json
ops.json resides on each of the SHC members. It is a commit history for the changes made to KOs and other configurations on the SH for the time period it covers.

It will contain references to the roles you removed until the ops.json window shifts past the date where the changes were made or applied on the SHC members.