https://community.splunk.com/t5/Getting-Data-In/remove-custom-csv-file-of-threat-intellignance/m-p/483355#M82803 <P>sorry still my problem not solved.</P> <P>Still the "threat activity detected" is triggering against custom uploaded csv file. </P> <P>However when I give below command <BR /> | inputlookup ip_intel | search threat_key="abc"</P> <P>I am not seeing any feed datas when I do </P> <P>and under threat activity dashboard I can see that the custom csv upload threat feed is still ative against <BR /> most active threat sources</P> Wed, 30 Sep 2020 03:00:09 GMT riqbal47010 2020-09-30T03:00:09Z https://community.splunk.com/t5/Getting-Data-In/remove-custom-csv-file-of-threat-intellignance/m-p/483353#M82801 <P>hi </P> <P>I uploaded custom csv file containing IP addresses. <BR /> Referring link "<A href="https://docs.splunk.com/Documentation/ES/latest/API/ThreatIntelligenceAPIreference">https://docs.splunk.com/Documentation/ES/latest/API/ThreatIntelligenceAPIreference</A>". I have to remove data rows one by one.<BR /> there are 400 Ip's against that IP.</P> <P>So I have to execute this command 400 times ?<BR /> PR there is some other way to remove these feeds from threat intelligance KV store.</P> Thu, 14 Nov 2019 13:22:22 GMT https://community.splunk.com/t5/Getting-Data-In/remove-custom-csv-file-of-threat-intellignance/m-p/483353#M82801 riqbal47010 2019-11-14T13:22:22Z https://community.splunk.com/t5/Getting-Data-In/remove-custom-csv-file-of-threat-intellignance/m-p/483354#M82802 <P>Please refer this <A href="https://answers.splunk.com/answers/683921/how-do-i-remove-iocs-from-a-kv-store.html">https://answers.splunk.com/answers/683921/how-do-i-remove-iocs-from-a-kv-store.html</A></P> Thu, 14 Nov 2019 14:16:54 GMT https://community.splunk.com/t5/Getting-Data-In/remove-custom-csv-file-of-threat-intellignance/m-p/483354#M82802 harsmarvania57 2019-11-14T14:16:54Z https://community.splunk.com/t5/Getting-Data-In/remove-custom-csv-file-of-threat-intellignance/m-p/483355#M82803 <P>sorry still my problem not solved.</P> <P>Still the "threat activity detected" is triggering against custom uploaded csv file. </P> <P>However when I give below command <BR /> | inputlookup ip_intel | search threat_key="abc"</P> <P>I am not seeing any feed datas when I do </P> <P>and under threat activity dashboard I can see that the custom csv upload threat feed is still ative against <BR /> most active threat sources</P> Wed, 30 Sep 2020 03:00:09 GMT https://community.splunk.com/t5/Getting-Data-In/remove-custom-csv-file-of-threat-intellignance/m-p/483355#M82803 riqbal47010 2020-09-30T03:00:09Z