All Apps and Add-ons

How to delete a KV STORE lookup?

agentsofshield
Path Finder

I have write permissions on a KV Store lookup. When I try to press "delete" on the Lookup Editor app, it says "Lookup file could not be deleted". I'm not trying to delete information, I want to delete the whole lookup. How can I do this?

ro_mc
Path Finder

To delete the config for the collection, rather than the records within it, use:

curl -k -u admin:changeme -X DELETE https://<host>:8089/servicesNS/nobody/<app>/storage/collections/config/<collection>

Deleting the transform lookup configuration may still work, but this is the solution currently provided in the Splunk docs at https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/

0 Karma

ilyaresh
Path Finder

Hi,
Have you tried to send DELETE call to
https://{{sh_url}}:8089/servicesNS/nobody/{{sh_app_name}}/data/transforms/lookups/{{lookup_name}}
you might need to change nobody to specific user if the lookup is defined having user and not app level permission.

for example using curl

curl -X DELETE \
  https://{{sh_url}}:8089/servicesNS/nobody/{{sh_app_name}}/data/transforms/lookups/{{lookup_name}}

Regards,
ILYA

0 Karma

agentsofshield
Path Finder

I tried to use clean command, on the server it said "deleted" but Lookup Editor still claims the lookup exists.

The simple command "|outputlookup " won't help me because I want to delete the lookup table itself and not just the data.

0 Karma

vnravikumar
Champion

Hi

Try the following command

curl -k -u splunkadmin:splunkadmin --request DELETE https://localhost:8089/servicesNS/splunkadmin/search/data/transforms/lookups/lookuptest

Here
splunkadmin is the username/password
lookuptest is the definition name.
search is the app name

0 Karma

agentsofshield
Path Finder

Sorry, I tried and it says "curl: (35) TCP connection reset by peer" even after replacing the values you mentioned ever with different admin users.

Is there no way to use the GUI to delete?

0 Karma

vnravikumar
Champion

Try the above command and let me know.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...