remove data from kvstore

[sarit_s]

Hello

i'm trying to remove the data i have in kvstore collection.
im using this command :

splunk clean  kvstore  -app system -collection alerts_prod

im getting message that there is nothing to remove even though i see that there is

$clusterTime.clusterTime.$timestamp.i $clusterTime.clusterTime.$timestamp.t $clusterTime.signature.hash.$binary $clusterTime.signature.hash.$type $clusterTime.signature.keyId App Collection author avgObjSize capped count data dbsize eai:acl.app eai:acl.can_list eai:acl.can_write eai:acl.modifiable eai:acl.owner eai:acl.perms.read eai:acl.perms.write eai:acl.removable eai:acl.sharing id indexSizes.UserAndKeyUniqueIndex indexSizes._id indexsize lastExtentSize nindexes ns numExtents ok operationTime.$timestamp.i operationTime.$timestamp.t paddingFactor paddingFactorNote published size splunk_server storageSize title totalIndexSize updated userFlags
1 1585936837 AAAAAAAAAAAAAAAAAAAAAAAAAAA= 00 0 system alerts_prod system 266059 false 180 {"ns":"system.alerts_prod","size":47890624,"count":180,"avgObjSize":266059,"numExtents":8,"storageSize":61513728,"lastExtentSize":33554432,"paddingFactor":1,"paddingFactorNote":"paddingFactor is unused and unmaintained in 3.0. It remains hard coded to 1.0 for compatibility only.","userFlags":1,"capped":false,"nindexes":2,"indexDetails":{},"totalIndexSize":32704,"indexSizes":{"id":8176,"_UserAndKeyUniqueIndex":24528},"ok":1,"operationTime":{"$timestamp":{"t":1585936837,"i":1}},"$clusterTime":{"clusterTime":{"$timestamp":{"t":1585936837,"i":1}},"signature":{"hash":{"$binary":"AAAAAAAAAAAAAAAAAAAAAAAAAAA=","$type":"00"},"keyId":0}}}

what am i missing ?

thanks

[manjunathmeti]

Check if this collection is part of any other app. If yes remove collection for that app. If this doesn't work you can remove kvstore collection alerts_prod, restart splunk and add it again.

$SPLUNK_HOME/bin/splunk btool --debug collections list