All Apps and Add-ons
Highlighted

How to delete a KV STORE lookup?

Path Finder

I have write permissions on a KV Store lookup. When I try to press "delete" on the Lookup Editor app, it says "Lookup file could not be deleted". I'm not trying to delete information, I want to delete the whole lookup. How can I do this?

0 Karma
Highlighted

Re: How to delete a KV STORE lookup?

Champion
0 Karma
Highlighted

Re: How to delete a KV STORE lookup?

Path Finder

I tried to use clean command, on the server it said "deleted" but Lookup Editor still claims the lookup exists.

The simple command "|outputlookup " won't help me because I want to delete the lookup table itself and not just the data.

0 Karma
Highlighted

Re: How to delete a KV STORE lookup?

Champion

Hi

Try the following command

curl -k -u splunkadmin:splunkadmin --request DELETE https://localhost:8089/servicesNS/splunkadmin/search/data/transforms/lookups/lookuptest

Here
splunkadmin is the username/password
lookuptest is the definition name.
search is the app name

0 Karma
Highlighted

Re: How to delete a KV STORE lookup?

Champion

Try the above command and let me know.

0 Karma
Highlighted

Re: How to delete a KV STORE lookup?

Path Finder

Sorry, I tried and it says "curl: (35) TCP connection reset by peer" even after replacing the values you mentioned ever with different admin users.

Is there no way to use the GUI to delete?

0 Karma
Highlighted

Re: How to delete a KV STORE lookup?

Path Finder

Hi,
Have you tried to send DELETE call to
https://{{shurl}}:8089/servicesNS/nobody/{{shappname}}/data/transforms/lookups/{{lookupname}}
you might need to change nobody to specific user if the lookup is defined having user and not app level permission.

for example using curl

curl -X DELETE \
  https://{{sh_url}}:8089/servicesNS/nobody/{{sh_app_name}}/data/transforms/lookups/{{lookup_name}}

Regards,
ILYA

0 Karma