Splunk Search

How do I delete lookup file (CSV) from a lookup lists using query?

harishalipaka
Motivator

Hi All,

When i run this query |rest services/data/lookup-table-files I get a list of CSV data.
From that, i want to delete one specific csv . How can i achieve this?

I tried |rest services/data/lookup-table-files |where title="hari.csv" |delete but I didn't get it.

Can you please help me with this?

Thanks in advance 🙂

Thanks
Harish

harsmarvania57
Ultra Champion

Hi @harishalipaka,

If you want to delete lookup CSV file using REST API then you need to use REST API DELETE request which you can't achieve with command which you mentioned, may be you can create custom command which pass lookup file name from REST API GET output to python script (You need to create this script) and script will run REST API DELETE request from that output.

Below is command which is working fine for me in my lab, in below command USERNAME and APP_NAME you need to provide explicitly, you can't use - (wildcard)

curl -vk -u admin:password --request DELETE https://localhost:8089/servicesNS/<USERNAME>/<APP_NAME>/data/lookup-table-files/test.csv

EDIT: Updated curl command

lim2
Communicator

I specified curl -vk -u admin:password --request DELETE https://sh-ip-address:8089/servicesNS///data/lookup-table-files/test.csv
Anyone got the following in a clustered SH env?

<msg type="ERROR">Object id=test.csv cannot be deleted in config=lookups.</msg>

harishalipaka
Motivator

Hi @niketn , @somesoni2 , @martin_mueller , @kamlesh_vaghela , @woodcock , @493669

Please help for this.

Thanks
Harish
0 Karma

niketn
Legend

@harishalipaka try the Lookup Editor App

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...