Knowledge Management

How to remove entry from kvstore?


I’m working with a kvstore since the Netskope IP information needs updating.  I figured out how to add to it using this SPL



| makeresults
| eval Data="aaa.bbb.ccc.ddd/mask"
| eval Desc="Netskope"
| eval Type="netskope_ip"
| outputlookup append=true override_if_empty=false my_kvstore



I found multiple examples of how to delete

curl -k -u admin:yourpassword -X DELETE https://localhost:8089/servicesNS/nobody/kvstoretest/storage/collections/data/kvstorecoll/5410be5441...

The thing is I can’t find the data path.  I can’t use the above command replacing the path the correct path if I can’t figure out the correct path.  Any suggestions?



Labels (1)
0 Karma
1 Solution


Thanks.  My googlefu didn't find that one.  Part 2 had the command I was looking for.

| inputlookup task_lookup | eval key=_key | WHERE NOT key=<specific_id> | 
outputlookup task_lookup

 Thanks for the help.


0 Karma

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...