How to delete old lookup table (CSV) files in a search head clustering environment?

[BP9906]

How can one delete stale lookup files? Sometimes users output their data to a lookup table file to reference in another search and fail to remove the old lookup table file. This in turn causes the bundle replication to be large. (Yes I should exclude lookups from replication, but the problem is that automatic lookups don't allow you to auto append the "local=true" thus the tricky business involved)

Thank you.

[somesoni2]

As a admin, you could delete the old lookups from One of the Search Head and it should remove the lookup from all other members of SHC. ( Settings-> Lookups-> Lookup table files -> Find and click on delete).

Alternatively, you can delete those lookups from the file-system on each of the SH manually (file system changes doesn't get replicated).

Also, you can use Splunk's REST Api Endpoints using curl to delete the lookups

curl -k -u admin:pass --request DELETE https://localhost:8089/servicesNS/admin/search/data/lookup-table-files/lookupToDelete.csv

[scheng_splunk]

when you delete lookup through REST API it actually gets synced through SHC which means you only need to delete the lookup from one SH and the same lookup file will be removed from all the SHs in the cluster per my lab test.

[reaching99]

sourcetype="yourfilename.csv" | delete

[somesoni2]

Lookup table files are not indexed data.