Splunk Search

How can I remove one record from the KV store using a search without reloading the whole thing?

okrabbe_splunk
Splunk Employee
Splunk Employee

How can I remove one record from the KV store using a search without reloading the whole thing?

For example, I know I can do the following

|inputlookup my_lookup | search NOT _key="123345" | outputlookup my_lookup

Is there a more efficient method?

Tags (2)
0 Karma

AkshayPI
Engager

In CLI, run this:

curl -k -u user:pass -X DELETE \
    https://localhost:8089/servicesNS/yourusername/yourappname/storage/collections/data/kvstorecollectio...

Here, the "kvstorecollection" is the name of the KV store collection that you defined in collections.conf

Cheers,
Akshay

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...