remove data from kvstore

sarit_s — Wed, 30 Sep 2020 04:54:02 GMT

Hello

i'm trying to remove the data i have in kvstore collection.
im using this command :

splunk clean  kvstore  -app system -collection alerts_prod

im getting message that there is nothing to remove even though i see that there is

$clusterTime.clusterTime.$timestamp.i $clusterTime.clusterTime.$timestamp.t $clusterTime.signature.hash.$binary $clusterTime.signature.hash.$type $clusterTime.signature.keyId App Collection author avgObjSize capped count data dbsize eai:acl.app eai:acl.can_list eai:acl.can_write eai:acl.modifiable eai:acl.owner eai:acl.perms.read eai:acl.perms.write eai:acl.removable eai:acl.sharing id indexSizes.UserAndKeyUniqueIndex indexSizes._id indexsize lastExtentSize nindexes ns numExtents ok operationTime.$timestamp.i operationTime.$timestamp.t paddingFactor paddingFactorNote published size splunk_server storageSize title totalIndexSize updated userFlags
1 1585936837 AAAAAAAAAAAAAAAAAAAAAAAAAAA= 00 0 system alerts_prod system 266059 false 180 {"ns":"system.alerts_prod","size":47890624,"count":180,"avgObjSize":266059,"numExtents":8,"storageSize":61513728,"lastExtentSize":33554432,"paddingFactor":1,"paddingFactorNote":"paddingFactor is unused and unmaintained in 3.0. It remains hard coded to 1.0 for compatibility only.","userFlags":1,"capped":false,"nindexes":2,"indexDetails":{},"totalIndexSize":32704,"indexSizes":{"id":8176,"_UserAndKeyUniqueIndex":24528},"ok":1,"operationTime":{"$timestamp":{"t":1585936837,"i":1}},"$clusterTime":{"clusterTime":{"$timestamp":{"t":1585936837,"i":1}},"signature":{"hash":{"$binary":"AAAAAAAAAAAAAAAAAAAAAAAAAAA=","$type":"00"},"keyId":0}}}

what am i missing ?

thanks

Re: remove data from kvstore

manjunathmeti — Fri, 03 Apr 2020 21:00:04 GMT

Check if this collection is part of any other app. If yes remove collection for that app. If this doesn't work you can remove kvstore collection alerts_prod, restart splunk and add it again.

$SPLUNK_HOME/bin/splunk btool --debug collections list

topic remove data from kvstore in Knowledge Management

remove data from kvstore

Re: remove data from kvstore