How to remove entry from kvstore?

[jwhughes58]

I’m working with a kvstore since the Netskope IP information needs updating.  I figured out how to add to it using this SPL

| makeresults
| eval Data="aaa.bbb.ccc.ddd/mask"
| eval Desc="Netskope"
| eval Type="netskope_ip"
| outputlookup append=true override_if_empty=false my_kvstore

I found multiple examples of how to delete

curl -k -u admin:yourpassword -X DELETE https://localhost:8089/servicesNS/nobody/kvstoretest/storage/collections/data/kvstorecoll/5410be5441...

The thing is I can’t find the data path.  I can’t use the above command replacing the path the correct path if I can’t figure out the correct path.  Any suggestions?

TIA,

Joe

[jwhughes58]

Thanks.  My googlefu didn't find that one.  Part 2 had the command I was looking for.

| inputlookup task_lookup | eval key=_key | WHERE NOT key=<specific_id> | 
outputlookup task_lookup

 Thanks for the help.

Joe

[isoutamo · Accepted solution]

Hi
have you already read this https://hurricanelabs.com/splunk-tutorials/creating-and-cruding-a-kv-store-in-splunk-part-1/ ?
r. Ismo