Splunk Search
Highlighted

How to refresh the list of servers in the SOS app

Communicator

I removed a server from my cluster, and it still shows up in the dropdowns of the SOS app.
How is it maintained, can I reset the list ?

Tags (2)
Highlighted

Re: How to refresh the list of servers in the SOS app

Splunk Employee
Splunk Employee

The list of servers is maintained in a lookup in the SOS app.

1 - You can reset this lookup,
go to SOS > Lookups » Lookup table files
and remove .../splunkserverscache.csv

2- Then regenerate it using the search "sosrefreshsplunkserverscache" from the context of the SOS app.

By default the search is scheduled to run every 15 minutes, but append to the existing list, so you need to reset to clear servers.

View solution in original post

Highlighted

Re: How to refresh the list of servers in the SOS app

Splunk Employee
Splunk Employee

The full list if in $SPLUNKHOME/etc/apps/sos/lookups
splunk
forwarderscache.csv
splunk
instancesinfo.csv
splunk
servers_cache.csv

You can regenerate them using the searches :
[sosrefreshsplunkforwarderscache]
[sossplunkforwarders_info]
[sosrefreshsplunkserverscache]
[sossplunkinstances_info]

0 Karma