Splunk Search

Delete specific entries from KV Store

srinivasgowda
Explorer

Hello all,

 

I am working on getting specific entries deleted once the search runs and holds true.

Below is the detailed outline of what I am trying to achieve.

 

The recovery_flag in the kv store that contains the data of source is set to 1 and 0 based on the requirement. However, I am trying to delete the entries with recovery_flag = 0 on the next run of the  search, this way the unwanted entries are removed. Can you guide me through this.

 

Thank you.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Have you try this: https://splunkbase.splunk.com/app/5328/ ?
I'm using it for kvstore backups on SHC / SH environments, but haven't try it with managing individual keys.
r. Ismo
0 Karma

manjunathmeti
Champion

hi @srinivasgowda,
You can use rest API to delete records in kvstore collection. Replace APP_NAME and KVSTORE_COLLECTION_NAME and run the below command. You can also use tools like the postman to achieve this. 

curl -k -u admin:changeme https://SPLUNK_SERVER_IP:8089/servicesNS/nobody/APP_NAME/storage/collections/data/KVSTORE_COLLECTION_NAME -X DELETE -H "Content-Type: application/json" -d '{ "query":{"recovery_flag":0}}'

 

If this reply helps you, an upvote/like would be appreciated.

  

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!