topic Re: How to delete data from a KVStore based on some criteria in Splunk Dev

How to delete data from a KVStore based on some criteria

splunkrocks2014 — Fri, 27 Apr 2018 18:46:19 GMT

How can I delete data from a KV store based on some criteria, for instance, to delete the aged data based on a timestamp field?

Thanks.

Re: How to delete data from a KVStore based on some criteria

niketn — Tue, 01 May 2018 09:02:25 GMT

@splunkrocks2014, perform inputlookup on KV Store, then apply search filter to get data only falling in the recent required time. Finally perform outputlookup to the same KV Store to keep only required results.

You can then save the search as Scheduled Report to perform this on a regular basis.

If you can not figure out the query and need further help from the community members, you can add further details like KV Store name, and name of the fields along with sample data. Also what is the criteria for Date Range to drop events from KV Store? Is you timestamp field String Date or Epoch Date?

Re: How to delete data from a KVStore based on some criteria

splunkrocks2014 — Tue, 01 May 2018 19:36:50 GMT

I was thinking the way you described, but it doesn't work.

Re: How to delete data from a KVStore based on some criteria

niketn — Tue, 01 May 2018 20:37:13 GMT

Inputlookup and search should work. May I know if the issue is with outputlookup? Are you seeing any error in Job Inspector/Splunk _internal logs?

Re: How to delete data from a KVStore based on some criteria

PowerPacked — Wed, 02 May 2018 02:01:32 GMT

You can also delete data from KVstore using REST API

Please look at this doc.

http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG

Delete the record with the key ID " 5410be5441ba15298e4624d1":

curl -k -u admin:changeme -X DELETE \
https://localhost:8089/servicesNS/nobody/kvstoretest/storage/collections/data/kvstorecoll/5410be5441ba15298e4624d1

if you don't have permissions to the box - then use the Rest command in UI

Re: How to delete data from a KVStore based on some criteria

andrewtrobec — Thu, 19 Mar 2020 14:24:57 GMT

@PowerPacked If you're still alive on this forum i'd really appreciate if you could elaborate on

if you don't have permissions to the box - then use the Rest command in UI

I'm trying to figure out exactly how to delete a specific key from KV Store via UI. If you have any sample code or links or anything that could push me in the righ direction then please share 🙂

Regards,

Andrew