Using Splunk API to remove agents from deployment server

[cameronr0705]

We have an asset database that keeps track of decommissioned assets. We can make a table of all decommissioned assets in our environment. Is there a way to use the REST API to remove those assets from the deployment server.

Something like:
"Status="end of life"| foreach AssetName rest DELETE https://localhost:8089/services/deployment/server/clients/AssetName"

[gjanders]

You could install an app like https://splunkbase.splunk.com/app/4146/ and use the | curl method=delete option, it will involve a few tricks and most likely you would want a | map to run the curl command many times.

You might need to apply this fix if installing version 1.2.3 for the TA webtools.

[richgalloway]

You have the right idea, but POST and DELETE operations cannot be performed from a search. You'll have to write a script that reads your list of decommissioned assets and sends the REST commands to Splunk using curl or similar.