All Apps and Add-ons

Why can't I delete entities from the Splunk App for Infrastructure?

9eagles
Explorer

Version: App for Infrastructure 1.2.1
Splunk Enterprise 7.2

I have duplicate entities in the Splunk App for Infrastructure Console.

I reran the installation script from the "Add Data" panel for a Linux machine in order to add more dimensions. This is per the instructions for when you need to add or change dimensions.

I ended up with 2 entities. Each has different dimensions, but I do not want 2 in the console.

I tried to delete the old one in the "investigate" panel, but it just keeps coming back. Even deleting it from the kvstore does not work. It comes right back.

Any ideas?

Info: Setup per instructions:
heavy forwarder: Infra App, Infra Add-on, HEC Collector
search head: Infra App, kvstore
indexer: Infra Add-on
Linux Endpoint: UF, Collectd (via the infra App Script)

0 Karma

9eagles
Explorer

The entity seemed to age out after a week or so. Could have also been something I did extra to get rid of it. Here's everything I ended up doing:
1. Re-ran the script (after updating it with new dimensions)
2. Verified collectd.conf was correct after my changes
3. Deleted it from the investigate panel
4. Deleted it from the kvstore
5. Removed everything from the /etc/collectd/ directory (collectd asset path but just collectd.log was there) and restarted collectd
6. Waited about a week and it showed as inactive in the panel, deleted it and it never came back

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...