All Apps and Add-ons

Why can't I delete entities from the Splunk App for Infrastructure?

9eagles
Explorer

Version: App for Infrastructure 1.2.1
Splunk Enterprise 7.2

I have duplicate entities in the Splunk App for Infrastructure Console.

I reran the installation script from the "Add Data" panel for a Linux machine in order to add more dimensions. This is per the instructions for when you need to add or change dimensions.

I ended up with 2 entities. Each has different dimensions, but I do not want 2 in the console.

I tried to delete the old one in the "investigate" panel, but it just keeps coming back. Even deleting it from the kvstore does not work. It comes right back.

Any ideas?

Info: Setup per instructions:
heavy forwarder: Infra App, Infra Add-on, HEC Collector
search head: Infra App, kvstore
indexer: Infra Add-on
Linux Endpoint: UF, Collectd (via the infra App Script)

0 Karma

9eagles
Explorer

The entity seemed to age out after a week or so. Could have also been something I did extra to get rid of it. Here's everything I ended up doing:
1. Re-ran the script (after updating it with new dimensions)
2. Verified collectd.conf was correct after my changes
3. Deleted it from the investigate panel
4. Deleted it from the kvstore
5. Removed everything from the /etc/collectd/ directory (collectd asset path but just collectd.log was there) and restarted collectd
6. Waited about a week and it showed as inactive in the panel, deleted it and it never came back

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...