I have kv lookup table named bingo_kv_table. There are multiple rows having same hosts along with other hosts. I want to run a splunk query to remove all the rows having a particular host name. Other fields along with are start_date, start_time, end_date, end_time, title, user_name.
I can extract the table using
|inputlookup bingo_kv_table|streamstats count as row |search host_list="*host*"
I want to delete multiple rows having same host name. What command should I run without manually deleting each entry
This will remove all rows with host name of "foo".
|inputlookup bingo_kv_table where host!="foo"
|streamstats count as row
|search host_list="*host*"