How to delete a KV STORE lookup?

[agentsofshield]

I have write permissions on a KV Store lookup. When I try to press "delete" on the Lookup Editor app, it says "Lookup file could not be deleted". I'm not trying to delete information, I want to delete the whole lookup. How can I do this?

[ro_mc]

To delete the config for the collection, rather than the records within it, use:

curl -k -u admin:changeme -X DELETE https://<host>:8089/servicesNS/nobody/<app>/storage/collections/config/<collection>

Deleting the transform lookup configuration may still work, but this is the solution currently provided in the Splunk docs at https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/

[ilyaresh]

Hi,
Have you tried to send DELETE call to
https://{{sh_url}}:8089/servicesNS/nobody/{{sh_app_name}}/data/transforms/lookups/{{lookup_name}}
you might need to change nobody to specific user if the lookup is defined having user and not app level permission.

for example using curl

curl -X DELETE \
  https://{{sh_url}}:8089/servicesNS/nobody/{{sh_app_name}}/data/transforms/lookups/{{lookup_name}}

Regards,
ILYA

[vnravikumar]

Hi

Check these links

http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG

https://answers.splunk.com/answers/237859/can-i-delete-all-data-from-a-kv-store-at-once.html

[agentsofshield]

I tried to use clean command, on the server it said "deleted" but Lookup Editor still claims the lookup exists.

The simple command "|outputlookup " won't help me because I want to delete the lookup table itself and not just the data.

[vnravikumar]

Hi

Try the following command

curl -k -u splunkadmin:splunkadmin --request DELETE https://localhost:8089/servicesNS/splunkadmin/search/data/transforms/lookups/lookuptest

Here
splunkadmin is the username/password
lookuptest is the definition name.
search is the app name

[agentsofshield]

Sorry, I tried and it says "curl: (35) TCP connection reset by peer" even after replacing the values you mentioned ever with different admin users.

Is there no way to use the GUI to delete?

[vnravikumar]

Try the above command and let me know.