How can we delete particular data from KVStore using REST API/ CURL without using _key?

kamlesh_vaghela — Mon, 20 Apr 2020 05:33:08 GMT

Here, the requirement is to delete all the data from KVStore having the particular KVStore filed value.

Example: I have a KVStore for student data with Name, Std, roll_number.

In my KVStore, I have all the student information across all the standards.

So my use cases re,

If I want to delete all the records of 10th standard's students then how can I do using REST API
If I want to delete all the records of 5th to 10th standard's students then how can I do using REST API.

You can create as many use cases as you think. 🙂

Re: How can we delete particular data from KVStore using REST API/ CURL without using _key?

kamlesh_vaghela — Mon, 20 Apr 2020 05:35:22 GMT

By using below options, you can delete all the records from specific collection OR delete specific records from specific collection using _key ID. Let's see all the ways of deleting records using CURL.

1) Delete all records in the "kvstorecoll" collection:

curl -k -u admin:yourpassword -X DELETE https://localhost:8089/servicesNS/nobody/kvstoretest/storage/collections/data/kvstorecoll

2) Delete the record with the key ID " 5410be5441ba15298e4624d1":

curl -k -u admin:yourpassword -X DELETE https://localhost:8089/servicesNS/nobody/kvstoretest/storage/collections/data/kvstorecoll/5410be5441ba15298e4624d1

You can find the above curl commands in https://dev.splunk.com/enterprise/docs/developapps/kvstore/ documentation.

As per our requirement, we need to delete specific records.

For deleting specific records, we have to use query parameters in our REST/CURL.

3) Delete the records with the Standard value 10

curl -k -u admin:admin123 https://localhost:8089/servicesNS/nobody/test/storage/collections/data/kvstorecoll\?query\=\{\"std\":10\} -g -X DELETE

4) Delete the records with the Standard value from 5 to 10

curl -k -u admin:admin123 https://localhost:8089/servicesNS/nobody/test/storage/collections/data/kvstorecoll\?query\=\{\"\$and\":\[\{\"std\":\{\"\$gt\":4\}\},\{\"id\":\{\"$lt\":11\}\}\]\} -g -X DELETE

Note: In case, any REST/CURL not working as expected then make sure your query parameter value which should be encoded with the % encoding.

My 4th example doesn't work properly for me for a few cases. So converted it into % encoding and It works like charm.

Updated 4)

curl -k -u admin:admin123 https://localhost:8089/servicesNS/nobody/test/storage/collections/data/kvstorecoll\?query=%7B%20%22%24and%22%3A%20%5B%20%7B%20%22id%22%3A%20%7B%20%22%24gt%22%3A%205%20%7D%20%7D%2C%20%7B%20%22id%22%3A%20%7B%20%22%24lt%22%3A%2013%20%7D%20%7D%20%5D%20%7D%0A -g -X DELETE

You can find more about the query parameters and operators in the below docs.

https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTkvstore

Happy Splunking

Re: How can we delete particular data from KVStore using REST API/ CURL without using _key?

jkat54 — Mon, 20 Apr 2020 11:27:35 GMT

There are a couple of apps out there that give you a curl SPL command too... you could in theory do this from splunk search.

topic How can we delete particular data from KVStore using REST API/ CURL without using _key? in Getting Data In

How can we delete particular data from KVStore using REST API/ CURL without using _key?

Re: How can we delete particular data from KVStore using REST API/ CURL without using _key?

Re: How can we delete particular data from KVStore using REST API/ CURL without using _key?