Archive

Search Head Cluster: How to cleanup search and reporting app

shihabno
New Member

Our search and reporting app on SHC are used for long and became messy. We created new app to move everything from search app.
What will be the best approach here?

I can create new app and copy app/search/{local, lookups, metadata} and user/search/{{local, lookups, metadata} to that app and push from deployer. Still search app on members will have the duplicate copy and user will have private copies.
Need to clean the local search app on cluster.

Tags (1)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @shihabno,

If you are good at REST API and scripting then you can achieve this without copying knowledge objects to deployer but you need to use different rest api for different knowledge objects.

Reference doc http://docs.splunk.com/Documentation/Splunk/7.2.0/RESTUM/RESTusing#Access_Control_List

0 Karma

soumyasaha25
Contributor

probably you can look at the replication bundle and try to reduce the size of the unnecessary files that dont need to be replicated.

0 Karma