Splunk Search

Can you help me build a KVStore record deletion query?

anantdeshpande
Path Finder

hello,

Short background..
One of the application populates some ids for deletion of multiple types like type A, B, C, D. There are four different applications to delete each type of ids. I am interested in finding only the D type of ids. So I created a KVStore to store all ids for deletion. Then using lookup I am searching type D ids. Till this point everything works fine. But as data volume is huge, I want to delete the old records from KVStore which are already searched and displayed on dashboard. Please help me to build the last KVStore deletion query.

index=xyz STATUS="DELETED" | lookup scheduled_lookup SCHE_ID AS DEL_ID OUTPUT SCHE_ID AS DELETED_ACCT | stats count(DELETED_ACCT) as DELETED_ACCT

I want to build a query like below (please ignore syntax)

|inputlookup scheduled_lookup |eval key=_key |where NOT key=[index=xyz |fields DEL_ID] |outputlookup scheduled_lookup
0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...