Deployment Architecture

Using Splunk API to remove agents from deployment server

New Member

We have an asset database that keeps track of decommissioned assets. We can make a table of all decommissioned assets in our environment. Is there a way to use the REST API to remove those assets from the deployment server.

Something like:
"Status="end of life"| foreach AssetName rest DELETE https://localhost:8089/services/deployment/server/clients/AssetName"

0 Karma


You could install an app like and use the | curl method=delete option, it will involve a few tricks and most likely you would want a | map to run the curl command many times.

You might need to apply this fix if installing version 1.2.3 for the TA webtools.

0 Karma


You have the right idea, but POST and DELETE operations cannot be performed from a search. You'll have to write a script that reads your list of decommissioned assets and sends the REST commands to Splunk using curl or similar.

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!