What's ops.json in etc/system/replication?

[tfechner]

Hi,

we removed some roles and checked on file level where these roles still have a reference.
We found the file splunk/etc/system/replication/ops.json still hase a reference to the deleted roles.

We use SH-Cluster and idx-cluster.

Who has informations about this file?

Torsten

[nnmiller · Accepted solution]

splunk/etc/system/replication/ops.json

ops.json resides on each of the SHC members. It is a commit history for the changes made to KOs and other configurations on the SH for the time period it covers.

It will contain references to the roles you removed until the ops.json window shifts past the date where the changes were made or applied on the SHC members.

[harsmarvania57]

Hi,

How you removed the roles from Splunk Search Head Cluster ? If you modified authorize.conf and authentication.conf directly on SHC members then please do rolling restart of all SHC members.

[tfechner]

we removed the roles in the SH-cluster via the GUI. but some relicts are still in the config files, esp. local.meta

[harsmarvania57]

When you remove role from Search Head and if that role is used for read and write permission for knowledge objects then splunk will not remove it and knowledge objects permissions are in local.meta , you need to manually remove those.

[tfechner]

done. grep and xargs are your friend.
but still the question: what's done with ops.json

[harsmarvania57]

That file contains all files and config for Search Head Cluster state. For example {"dst":["nobody","system","authorize","role_ABC"] , this will indicate that you have role_ABC in $SPLUNK_HOME/etc/system and config in authorize.conf config file.

Please check whether all SHC members are in sync or not. If all SHC members are in sync then check configuration file for those roles which are reflecting in ops.json

[tfechner]

all members are in sync. mostly the location "$SPLUNK_HOME/var/run/splunk/lookup_tmp/" is the problem . this path is empty!