Splunk Search

How to delete a lookup table file and definition?

feickertmd
Communicator

I am testing some lookup files in a dev environment. I would like to clear out the first few tries and work with only the newest file and definition. I have no delete option the UI. The definitions allow me to disable, but I want to just wipe them out.

What is my course of action? Splunk 6.1x

Tags (2)

kschehr
Engager

If you have permissions you can delete them from Settings -> Lookups -> Lookup table files or Lookup Definitions.

On many browser window resolutions the delete option is on the far right and the page isn't rendered with a scroll bar. Zoom out or increase the resolution to see the delete option on the far right.

tedwroks
Explorer

I ran into something similar today, not sure if it's the same.
I could not find the delete for the definition I created, until...
I scrolled sideways to the right.

aamer4zangi
Path Finder

true.....:)

0 Karma

fdi01
Motivator

go to your splunk_home/bin directory in command line interface.
and run splunk clear ... command
you can run splunk help clear command to see all option about delete sommething

for me i use linux i do like this:
in CLI cd /opt/splunk/bin

./splunk option clear

to see option clear command before use to delete what you want.

note: you can use delete command.

sorry for my english.

0 Karma

juvetm
Communicator

hi fecikertmd;
Are sure of what you are saying i have created a lookup table file and defintion i can see the option delete on this UI both of them can you try it again but i will like to give you a reference that is what i try to use and i was able to see the option delete on UI on both of them in which i can delete .
please can you check on reference on the documentation Splunk-6.1.1-SearchTutorial i think this may help you . You will see how to do this lookup table file and the definition lookup very well on page 51 Splunk-6.1.1-SearchTutorial.
thanks

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...