Splunk Search

Delete specific entries from KV Store


Hello all,


I am working on getting specific entries deleted once the search runs and holds true.

Below is the detailed outline of what I am trying to achieve.


The recovery_flag in the kv store that contains the data of source is set to 1 and 0 based on the requirement. However, I am trying to delete the entries with recovery_flag = 0 on the next run of the  search, this way the unwanted entries are removed. Can you guide me through this.


Thank you.

Labels (1)
0 Karma

Have you try this: https://splunkbase.splunk.com/app/5328/ ?
I'm using it for kvstore backups on SHC / SH environments, but haven't try it with managing individual keys.
r. Ismo
0 Karma


hi @srinivasgowda,
You can use rest API to delete records in kvstore collection. Replace APP_NAME and KVSTORE_COLLECTION_NAME and run the below command. You can also use tools like the postman to achieve this. 

curl -k -u admin:changeme https://SPLUNK_SERVER_IP:8089/servicesNS/nobody/APP_NAME/storage/collections/data/KVSTORE_COLLECTION_NAME -X DELETE -H "Content-Type: application/json" -d '{ "query":{"recovery_flag":0}}'


If this reply helps you, an upvote/like would be appreciated.


0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!