Splunk Search

How to delete old lookup table (CSV) files in a search head clustering environment?

BP9906
Builder

How can one delete stale lookup files? Sometimes users output their data to a lookup table file to reference in another search and fail to remove the old lookup table file. This in turn causes the bundle replication to be large. (Yes I should exclude lookups from replication, but the problem is that automatic lookups don't allow you to auto append the "local=true" thus the tricky business involved)

Thank you.

somesoni2
Revered Legend

As a admin, you could delete the old lookups from One of the Search Head and it should remove the lookup from all other members of SHC. ( Settings-> Lookups-> Lookup table files -> Find and click on delete).

Alternatively, you can delete those lookups from the file-system on each of the SH manually (file system changes doesn't get replicated).

Also, you can use Splunk's REST Api Endpoints using curl to delete the lookups

curl -k -u admin:pass --request DELETE https://localhost:8089/servicesNS/admin/search/data/lookup-table-files/lookupToDelete.csv

scheng_splunk
Splunk Employee
Splunk Employee

when you delete lookup through REST API it actually gets synced through SHC which means you only need to delete the lookup from one SH and the same lookup file will be removed from all the SHs in the cluster per my lab test.

0 Karma

reaching99
New Member

sourcetype="yourfilename.csv" | delete

0 Karma

somesoni2
Revered Legend

Lookup table files are not indexed data.

0 Karma