Deployment Architecture

After migrating from search head pooling to search head clustering, how to delete automatic lookups in default/props.conf on the search heads?

cpetterborg
SplunkTrust
SplunkTrust

I need to remove some automatic lookups from the search heads (SH), but they are ones which were migrated from search head pooling to search head clustering, so they got migrated to the default directory on the SH's from the local directory on the deployer, so the GUI doesn’t allow deletion through it.

So, I have to remove them from the local/props.conf file on the deployer (as far as I know), and push the shcluster bundle. But when I have done this, the change doesn’t show up in the default/props.conf file where they live on the search heads.

Anyone know how I can successfully delete these automatic lookups?

It doesn't just affect lookups, however, it's the same for searches, and other such object that were migrated.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

I would do following steps to ensure complete cleanup
1) Remove automatic lookup (LOOKUP-....) from Deployer->etc/shcluster/apps/yourapp/local/props.conf (You've already done it)
2) Remove corresponding metadata entries from Deployer -> etc/shcluster/apps/yourapp/metadata/local.meta
3) Check and remove automatic lookup references from each Search Head (if present) -> etc/apps/yourapp/local/props.conf
4) Remove corresponding metadata entries from each Search Head (if present)-> etc/apps/yourapp/metadata/local.meta
5) Do a shcluster bundle push from Deployer and ensure each Search Head has restarted.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

I would do following steps to ensure complete cleanup
1) Remove automatic lookup (LOOKUP-....) from Deployer->etc/shcluster/apps/yourapp/local/props.conf (You've already done it)
2) Remove corresponding metadata entries from Deployer -> etc/shcluster/apps/yourapp/metadata/local.meta
3) Check and remove automatic lookup references from each Search Head (if present) -> etc/apps/yourapp/local/props.conf
4) Remove corresponding metadata entries from each Search Head (if present)-> etc/apps/yourapp/metadata/local.meta
5) Do a shcluster bundle push from Deployer and ensure each Search Head has restarted.

cpetterborg
SplunkTrust
SplunkTrust

That seems to do the trick. I've tried it on one of the lookups that I had to delete, and it now still shows up in the settings, but it had the delete option.

It's too bad that you have to go to each search head to delete the same things in there that you have to delete on the deployer. It may actually work just doing it on the deployer, I'm going to try it there next. The reason that I think it will work just on the deployer is that the props.conf appeared to have been updated on all the search heads. I did have to update the local.meta file on each of the search heads, because I had not updated that on the deployer and pushed the bundle before I worked on the search heads. I'll report back on that when I have finished with it.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Yes, it only required doing the deletion from the local.meta and props.conf on the deployer, then push the bundle out. The secret sauce ingredient was removing the data from the local.meta file in addition to the props.conf.

Thanks!!!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

We too faced similar issue (luckily we encountered this in lower environment itself so we're able to fix it before PROD) during SHP to SHC migration. Here are the steps that we followed to migrate SHP content to SHC. https://answers.splunk.com/answers/426842/how-do-you-manage-the-content-of-users-splunk-apps.html

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...