Splunk Search

How do I delete lookup file (CSV) from a lookup lists using query?

harishalipaka
Motivator

Hi All,

When i run this query |rest services/data/lookup-table-files I get a list of CSV data.
From that, i want to delete one specific csv . How can i achieve this?

I tried |rest services/data/lookup-table-files |where title="hari.csv" |delete but I didn't get it.

Can you please help me with this?

Thanks in advance :slightly_smiling_face:

Thanks
Harish

harsmarvania57
Ultra Champion

Hi @harishalipaka,

If you want to delete lookup CSV file using REST API then you need to use REST API DELETE request which you can't achieve with command which you mentioned, may be you can create custom command which pass lookup file name from REST API GET output to python script (You need to create this script) and script will run REST API DELETE request from that output.

Below is command which is working fine for me in my lab, in below command USERNAME and APP_NAME you need to provide explicitly, you can't use - (wildcard)

curl -vk -u admin:password --request DELETE https://localhost:8089/servicesNS/<USERNAME>/<APP_NAME>/data/lookup-table-files/test.csv

EDIT: Updated curl command

lim2
Communicator

I specified curl -vk -u admin:password --request DELETE https://sh-ip-address:8089/servicesNS///data/lookup-table-files/test.csv
Anyone got the following in a clustered SH env?

<msg type="ERROR">Object id=test.csv cannot be deleted in config=lookups.</msg>

harishalipaka
Motivator

Hi @niketn , @somesoni2 , @martin_mueller , @kamlesh_vaghela , @woodcock , @493669

Please help for this.

Thanks
Harish
0 Karma

niketn
Legend

@harishalipaka try the Lookup Editor App

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...