How to refresh the list of servers in the SOS app

[mataharry]

I removed a server from my cluster, and it still shows up in the dropdowns of the SOS app.
How is it maintained, can I reset the list ?

[yannK · Accepted solution]

The list of servers is maintained in a lookup in the SOS app.

1 - You can reset this lookup,
go to SOS > Lookups » Lookup table files
and remove .../splunk_servers_cache.csv

2- Then regenerate it using the search "sos_refresh_splunk_servers_cache" from the context of the SOS app.

By default the search is scheduled to run every 15 minutes, but append to the existing list, so you need to reset to clear servers.

[yannK]

The full list if in $SPLUNK_HOME/etc/apps/sos/lookups
splunk_forwarders_cache.csv
splunk_instances_info.csv
splunk_servers_cache.csv

You can regenerate them using the searches :
[sos_refresh_splunk_forwarders_cache]
[sos_splunk_forwarders_info]
[sos_refresh_splunk_servers_cache]
[sos_splunk_instances_info]