topic Re: How do I delete lookup file (CSV) from a lookup lists using query? in Splunk Search

How do I delete lookup file (CSV) from a lookup lists using query?

harishalipaka — Mon, 08 Oct 2018 11:18:14 GMT

Hi All,

When i run this query |rest services/data/lookup-table-files I get a list of CSV data.
From that, i want to delete one specific csv . How can i achieve this?

I tried |rest services/data/lookup-table-files |where title="hari.csv" |delete but I didn't get it.

Can you please help me with this?

Thanks in advance 🙂

Re: How do I delete lookup file (CSV) from a lookup lists using query?

harishalipaka — Tue, 29 Sep 2020 21:34:19 GMT

Hi @niketn , @somesoni2 , @martin_mueller , @kamlesh_vaghela , @woodcock , @493669

Please help for this.

Re: How do I delete lookup file (CSV) from a lookup lists using query?

niketn — Mon, 08 Oct 2018 12:49:49 GMT

@harishalipaka try the Lookup Editor App

Re: How do I delete lookup file (CSV) from a lookup lists using query?

harsmarvania57 — Mon, 08 Oct 2018 12:57:44 GMT

Hi @harishalipaka,

If you want to delete lookup CSV file using REST API then you need to use REST API DELETE request which you can't achieve with command which you mentioned, may be you can create custom command which pass lookup file name from REST API GET output to python script (You need to create this script) and script will run REST API DELETE request from that output.

Below is command which is working fine for me in my lab, in below command USERNAME and APP_NAME you need to provide explicitly, you can't use - (wildcard)

curl -vk -u admin:password --request DELETE https://localhost:8089/servicesNS/<USERNAME>/<APP_NAME>/data/lookup-table-files/test.csv

EDIT: Updated curl command

Re: How do I delete lookup file (CSV) from a lookup lists using query?

lim2 — Wed, 20 Nov 2019 15:37:44 GMT

I specified curl -vk -u admin:password --request DELETE https://sh-ip-address:8089/servicesNS///data/lookup-table-files/test.csv
Anyone got the following in a clustered SH env?

<msg type="ERROR">Object id=test.csv cannot be deleted in config=lookups.</msg>