Splunk Search

What's ops.json in etc/system/replication?

tfechner
Path Finder

Hi,

we removed some roles and checked on file level where these roles still have a reference.
We found the file splunk/etc/system/replication/ops.json still hase a reference to the deleted roles.

We use SH-Cluster and idx-cluster.

Who has informations about this file?

Torsten

Tags (1)
0 Karma
1 Solution

nnmiller
Contributor
splunk/etc/system/replication/ops.json

ops.json resides on each of the SHC members. It is a commit history for the changes made to KOs and other configurations on the SH for the time period it covers.

It will contain references to the roles you removed until the ops.json window shifts past the date where the changes were made or applied on the SHC members.

View solution in original post

nnmiller
Contributor
splunk/etc/system/replication/ops.json

ops.json resides on each of the SHC members. It is a commit history for the changes made to KOs and other configurations on the SH for the time period it covers.

It will contain references to the roles you removed until the ops.json window shifts past the date where the changes were made or applied on the SHC members.

harsmarvania57
Ultra Champion

Hi,

How you removed the roles from Splunk Search Head Cluster ? If you modified authorize.conf and authentication.conf directly on SHC members then please do rolling restart of all SHC members.

0 Karma

tfechner
Path Finder

we removed the roles in the SH-cluster via the GUI. but some relicts are still in the config files, esp. local.meta

0 Karma

harsmarvania57
Ultra Champion

When you remove role from Search Head and if that role is used for read and write permission for knowledge objects then splunk will not remove it and knowledge objects permissions are in local.meta , you need to manually remove those.

0 Karma

tfechner
Path Finder

done. grep and xargs are your friend.
but still the question: what's done with ops.json

0 Karma

harsmarvania57
Ultra Champion

That file contains all files and config for Search Head Cluster state. For example {"dst":["nobody","system","authorize","role_ABC"] , this will indicate that you have role_ABC in $SPLUNK_HOME/etc/system and config in authorize.conf config file.

Please check whether all SHC members are in sync or not. If all SHC members are in sync then check configuration file for those roles which are reflecting in ops.json

0 Karma

tfechner
Path Finder

all members are in sync. mostly the location "$SPLUNK_HOME/var/run/splunk/lookup_tmp/" is the problem . this path is empty!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...