How to delete data from a KVStore based on some criteria

[splunkrocks2014]

How can I delete data from a KV store based on some criteria, for instance, to delete the aged data based on a timestamp field?

Thanks.

[PowerPacked]

You can also delete data from KVstore using REST API

Please look at this doc.

http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG

Delete the record with the key ID " 5410be5441ba15298e4624d1":

curl -k -u admin:changeme -X DELETE \
https://localhost:8089/servicesNS/nobody/kvstoretest/storage/collections/data/kvstorecoll/5410be5441...

if you don't have permissions to the box - then use the Rest command in UI

[andrewtrobec]

@PowerPacked If you're still alive on this forum i'd really appreciate if you could elaborate on

if you don't have permissions to the box - then use the Rest command in UI

I'm trying to figure out exactly how to delete a specific key from KV Store via UI. If you have any sample code or links or anything that could push me in the righ direction then please share 🙂

Regards,

Andrew

[niketn]

@splunkrocks2014, perform inputlookup on KV Store, then apply search filter to get data only falling in the recent required time. Finally perform outputlookup to the same KV Store to keep only required results.

You can then save the search as Scheduled Report to perform this on a regular basis.

If you can not figure out the query and need further help from the community members, you can add further details like KV Store name, and name of the fields along with sample data. Also what is the criteria for Date Range to drop events from KV Store? Is you timestamp field String Date or Epoch Date?

[splunkrocks2014]

I was thinking the way you described, but it doesn't work.

[niketn]

Inputlookup and search should work. May I know if the issue is with outputlookup? Are you seeing any error in Job Inspector/Splunk _internal logs?