After migrating from search head pooling to search head clustering, how to delete automatic lookups in default/props.conf on the search heads?

[cpetterborg]

I need to remove some automatic lookups from the search heads (SH), but they are ones which were migrated from search head pooling to search head clustering, so they got migrated to the default directory on the SH's from the local directory on the deployer, so the GUI doesn’t allow deletion through it.

So, I have to remove them from the local/props.conf file on the deployer (as far as I know), and push the shcluster bundle. But when I have done this, the change doesn’t show up in the default/props.conf file where they live on the search heads.

Anyone know how I can successfully delete these automatic lookups?

It doesn't just affect lookups, however, it's the same for searches, and other such object that were migrated.

[somesoni2 · Accepted solution]

I would do following steps to ensure complete cleanup
1) Remove automatic lookup (LOOKUP-....) from Deployer->etc/shcluster/apps/yourapp/local/props.conf (You've already done it)
2) Remove corresponding metadata entries from Deployer -> etc/shcluster/apps/yourapp/metadata/local.meta
3) Check and remove automatic lookup references from each Search Head (if present) -> etc/apps/yourapp/local/props.conf
4) Remove corresponding metadata entries from each Search Head (if present)-> etc/apps/yourapp/metadata/local.meta
5) Do a shcluster bundle push from Deployer and ensure each Search Head has restarted.

[cpetterborg]

That seems to do the trick. I've tried it on one of the lookups that I had to delete, and it now still shows up in the settings, but it had the delete option.

It's too bad that you have to go to each search head to delete the same things in there that you have to delete on the deployer. It may actually work just doing it on the deployer, I'm going to try it there next. The reason that I think it will work just on the deployer is that the props.conf appeared to have been updated on all the search heads. I did have to update the local.meta file on each of the search heads, because I had not updated that on the deployer and pushed the bundle before I worked on the search heads. I'll report back on that when I have finished with it.

[cpetterborg]

Yes, it only required doing the deletion from the local.meta and props.conf on the deployer, then push the bundle out. The secret sauce ingredient was removing the data from the local.meta file in addition to the props.conf.

Thanks!!!

[somesoni2]

We too faced similar issue (luckily we encountered this in lower environment itself so we're able to fix it before PROD) during SHP to SHC migration. Here are the steps that we followed to migrate SHP content to SHC. https://answers.splunk.com/answers/426842/how-do-you-manage-the-content-of-users-splunk-apps.html