Splunk Search

How do I delete lookup file (CSV) from a lookup lists using query?

harishalipaka
Motivator

Hi All,

When i run this query |rest services/data/lookup-table-files I get a list of CSV data.
From that, i want to delete one specific csv . How can i achieve this?

I tried |rest services/data/lookup-table-files |where title="hari.csv" |delete but I didn't get it.

Can you please help me with this?

Thanks in advance 🙂

Thanks
Harish

harsmarvania57
Ultra Champion

Hi @harishalipaka,

If you want to delete lookup CSV file using REST API then you need to use REST API DELETE request which you can't achieve with command which you mentioned, may be you can create custom command which pass lookup file name from REST API GET output to python script (You need to create this script) and script will run REST API DELETE request from that output.

Below is command which is working fine for me in my lab, in below command USERNAME and APP_NAME you need to provide explicitly, you can't use - (wildcard)

curl -vk -u admin:password --request DELETE https://localhost:8089/servicesNS/<USERNAME>/<APP_NAME>/data/lookup-table-files/test.csv

EDIT: Updated curl command

lim2
Communicator

I specified curl -vk -u admin:password --request DELETE https://sh-ip-address:8089/servicesNS///data/lookup-table-files/test.csv
Anyone got the following in a clustered SH env?

<msg type="ERROR">Object id=test.csv cannot be deleted in config=lookups.</msg>

harishalipaka
Motivator

Hi @niketn , @somesoni2 , @martin_mueller , @kamlesh_vaghela , @woodcock , @493669

Please help for this.

Thanks
Harish
0 Karma

niketn
Legend

@harishalipaka try the Lookup Editor App

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...