Splunk Search
Highlighted

How can I remove one record from the KV store using a search without reloading the whole thing?

How can I remove one record from the KV store using a search without reloading the whole thing?

For example, I know I can do the following

|inputlookup my_lookup | search NOT _key="123345" | outputlookup my_lookup

Is there a more efficient method?

Tags (2)
0 Karma
Highlighted

Re: How can I remove one record from the KV store using a search without reloading the whole thing?

Engager

In CLI, run this:

curl -k -u user:pass -X DELETE \
    https://localhost:8089/servicesNS/yourusername/yourappname/storage/collections/data/kvstorecollectio...

Here, the "kvstorecollection" is the name of the KV store collection that you defined in collections.conf

Cheers,
Akshay

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.