Splunk Search

Query to delete multiple row in kvtable or csv table using splunk query

Saikat001
Explorer

I have  kv lookup table named bingo_kv_table. There are multiple rows having same hosts along with other hosts. I want to run a splunk query to remove all the rows having a particular host name. Other fields along with are start_date, start_time, end_date, end_time, title, user_name.

I can extract the table using

|inputlookup bingo_kv_table|streamstats count as row |search host_list="*host*"

 

 

I want to delete multiple rows having same host name. What command should I run without manually deleting each entry 

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This will remove all rows with host name of "foo".

|inputlookup bingo_kv_table where host!="foo"
|streamstats count as row 
|search host_list="*host*"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See Splunk Platform & Observability Innovations at Cisco Live EMEA

Hi Splunkers, Learn about what’s next for Splunk Platform at Cisco Live EMEA.  Data silos are a big challenge ...

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...