Knowledge Management

How to delete KV Store data older than 30 days?

AditiKulkarni
New Member

In our application, there is a requirement where we have to retain data in KV Store for a month (i.e. 30 days) and delete data that is older than 30 days. Is there any way/configuration where we can delete the KV Store data older than 30 days? I don't want to use scheduled search for this.

Could anyone give suggestion?

Tags (2)
0 Karma

tfechner
Path Finder

Any new possibility in 7.1 to remove old entries in a timebased kvstore?

0 Karma

masonmorales
Influencer

Do you store any kind of timestamp in your KV store? If so, what is it called and please give an example of its value.

0 Karma

masonmorales
Influencer

Also, you WILL have to use a scheduled search for this, but you only need to run it once/day. Just out of curiosity, why wouldn't you want to?

0 Karma

Jason
Motivator

As far as I know, there is no method for deleting individual records from the KV store using their keys, from the search bar, or automatically from a configuration somewhere.

You could use the inputlookup and outputlookup (without append=t) commands to bring in the entirety of the collection, search through it to keep what you want (likely some sort of where on a time field), and output it back to the kv store.

Deletion is currently handled through hitting a REST endpoint with a DELETE method. Example in the UI using the Javascript SDK.

Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...