hello,
Short background..
One of the application populates some ids for deletion of multiple types like type A, B, C, D. There are four different applications to delete each type of ids. I am interested in finding only the D type of ids. So I created a KVStore to store all ids for deletion. Then using lookup I am searching type D ids. Till this point everything works fine. But as data volume is huge, I want to delete the old records from KVStore which are already searched and displayed on dashboard. Please help me to build the last KVStore deletion query.
index=xyz STATUS="DELETED" | lookup scheduled_lookup SCHE_ID AS DEL_ID OUTPUT SCHE_ID AS DELETED_ACCT | stats count(DELETED_ACCT) as DELETED_ACCT
I want to build a query like below (please ignore syntax)
|inputlookup scheduled_lookup |eval key=_key |where NOT key=[index=xyz |fields DEL_ID] |outputlookup scheduled_lookup
