Knowledge Management

How to remove entry from kvstore?


I’m working with a kvstore since the Netskope IP information needs updating.  I figured out how to add to it using this SPL



| makeresults
| eval Data="aaa.bbb.ccc.ddd/mask"
| eval Desc="Netskope"
| eval Type="netskope_ip"
| outputlookup append=true override_if_empty=false my_kvstore



I found multiple examples of how to delete

curl -k -u admin:yourpassword -X DELETE https://localhost:8089/servicesNS/nobody/kvstoretest/storage/collections/data/kvstorecoll/5410be5441...

The thing is I can’t find the data path.  I can’t use the above command replacing the path the correct path if I can’t figure out the correct path.  Any suggestions?



Labels (1)
0 Karma
1 Solution


Thanks.  My googlefu didn't find that one.  Part 2 had the command I was looking for.

| inputlookup task_lookup | eval key=_key | WHERE NOT key=<specific_id> | 
outputlookup task_lookup

 Thanks for the help.


0 Karma

Get Updates on the Splunk Community!

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...