KV Store Help - Best approach to schedule deletion of records based on a flag set

[rkadam]

We have a KV store with below fields:
_key (mapped with alert_id)
Splunk_ID
Can_Delete (a flag with Yes/No)

KV Store records are being added/updated with schedule searches. Now our requirement is to delete all records from KV store whose Can_Delete flag is set to "Yes", on regular basis.

What is the best way to achieve this?

[ashmaind]

Hello, You can schedule a search with filter condition Can_Delete="Yes" followed by | outputlookup command . Hope you are clear.