Return the DMC to default settings

To return an instance's Distributed Management Console to the default (original) settings, use the following procedure:

1. Delete the $SPLUNK_HOME/etc/apps/splunk_management_console/local directory.

2. Delete the $SPLUNK_HOME/etc/apps/splunk_management_console/lookups directory.

3. In $SPLUNK_HOME/etc/system/local/distsearch.conf, delete any stanzas that reference distributed search groups created by the DMC. The names of these groups are usually prefaced with dmc_group_*.

The following is an example of how these stanzas usually appear in distsearch.conf:

[distributedSearch:dmc_group_cluster_master]
servers = localhost:localhost

[distributedSearch:dmc_group_deployment_server]

[distributedSearch:dmc_group_kv_store]

[distributedSearch:dmc_group_search_head]
servers = localhost:localhost,undiag02.sv.splunk.com:8089

[distributedSearch:dmc_group_license_master]
servers = localhost:localhost

[distributedSearch:dmc_customgroup_primary_search-head]
servers = undiag02.sv.splunk.com:8089

[distributedSearch:dmc_group_indexer]
default = true
servers = 10.159.4.67:8089,10.159.4.70:8089,10.159.4.71:8089,10.159.4.73:8089

4. Once you have deleted all stanzas, save your changes.

5. Restart Splunk Enterprise.