Hello all,
I am working on getting specific entries deleted once the search runs and holds true.
Below is the detailed outline of what I am trying to achieve.
The recovery_flag in the kv store that contains the data of source is set to 1 and 0 based on the requirement. However, I am trying to delete the entries with recovery_flag = 0 on the next run of the search, this way the unwanted entries are removed. Can you guide me through this.
Thank you.
hi @srinivasgowda,
You can use rest API to delete records in kvstore collection. Replace APP_NAME and KVSTORE_COLLECTION_NAME and run the below command. You can also use tools like the postman to achieve this.
curl -k -u admin:changeme https://SPLUNK_SERVER_IP:8089/servicesNS/nobody/APP_NAME/storage/collections/data/KVSTORE_COLLECTION_NAME -X DELETE -H "Content-Type: application/json" -d '{ "query":{"recovery_flag":0}}'
If this reply helps you, an upvote/like would be appreciated.