Splunk SOAR

SOAR Cloud - Bulk Delete Containers through API?

CS_
Path Finder

Hey all,

I'm trying to find a way to bulk delete containers via the API in SOAR Cloud.

Had an issue where Splunk created ~8000 containers  to one of my labels when testing, and no way am i going to sit here for an hour deleting them in the GUI.

I've read this post: How-to-Delete-Multiple-container but that really only points me to the single requests.delete option - which is very slow.

I can bulk update containers to change the status using requests.post and a list of container id's, but don't see any way to bulk delete.

For context a for loop + requests.delete on each single container is actually slower than deleting them via the GUI.

Am I missing it somewhere, or is this just not possible through API?

Labels (1)
0 Karma
1 Solution

CS_
Path Finder

Only just thought to check dev tools on my browser when deleting multiple containers, and yep - there is a way to pass the data so that it deletes multiple.

 

curl -X DELETE -H 'Content-Tpe: application/json' -H "ph-auth-token: <token>"  -d "{'ids': [1234, 1235, 1236, 1237]}"

 

(might need to slightly play around with this curl statement, as i haven't tried it.

And in Python it would look something like this.

 

data = {"ids": [1234, 12345, 1236, 1237]}
requests.delete("https://<soar_base_url_here>/container/"), headers={"ph-auth-token": "<some_token_here>"}, data=json.dumps(data), verify=False)

 



Enjoy!

View solution in original post

0 Karma

CS_
Path Finder

Only just thought to check dev tools on my browser when deleting multiple containers, and yep - there is a way to pass the data so that it deletes multiple.

 

curl -X DELETE -H 'Content-Tpe: application/json' -H "ph-auth-token: <token>"  -d "{'ids': [1234, 1235, 1236, 1237]}"

 

(might need to slightly play around with this curl statement, as i haven't tried it.

And in Python it would look something like this.

 

data = {"ids": [1234, 12345, 1236, 1237]}
requests.delete("https://<soar_base_url_here>/container/"), headers={"ph-auth-token": "<some_token_here>"}, data=json.dumps(data), verify=False)

 



Enjoy!

0 Karma

CS_
Path Finder

I just wrote a quick script to handle it, using multiprocessing.

If  you want to use it, just be careful how many API requests you are sending to your SOAR instance, and that it can handle it. Use at your own risk.

import requests
import multiprocessing

headers = {"ph-auth-token": "<some auth token here>"}
label = "<some label here>"
soar_base_url = "https://<replace_me.with.soar.url>"

# A function to for multiprocessing
def delete_container(container_id):
    requests.delete("{}/container/{}".format(soar_base_url, container_id), headers=headers, verify=False)
    print(container_id, " - Deleted")

# This is an example search that will get 50 Events from a label that are in the "new" status
# It will then sort them in ascending order (oldest to newset)
res = requests.get("{}/container/?page=0&page_size=50&sort=id&order=asc&_filter_label__in=['{}']&_filter_status__name='new'".format(soar_base_url, label), headers=headers, verify=False)
container_ids = [container_id["id"] for container_id in res.json()["data"]]

for container_id in container_ids:
    p = multiprocessing.Process(target=delete_container, args=(container_id,))
    p.start()
0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...