Building for the Splunk Platform

How to delete data from a KVStore based on some criteria

splunkrocks2014
Communicator

How can I delete data from a KV store based on some criteria, for instance, to delete the aged data based on a timestamp field?

Thanks.

Tags (1)
0 Karma

PowerPacked
Builder

You can also delete data from KVstore using REST API

Please look at this doc.

http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG

Delete the record with the key ID " 5410be5441ba15298e4624d1":

curl -k -u admin:changeme -X DELETE \
https://localhost:8089/servicesNS/nobody/kvstoretest/storage/collections/data/kvstorecoll/5410be5441...

if you don't have permissions to the box - then use the Rest command in UI

0 Karma

andrewtrobec
Builder

@PowerPacked If you're still alive on this forum i'd really appreciate if you could elaborate on

if you don't have permissions to the box - then use the Rest command in UI

I'm trying to figure out exactly how to delete a specific key from KV Store via UI. If you have any sample code or links or anything that could push me in the righ direction then please share 🙂

Regards,

Andrew

0 Karma

@splunkrocks2014, perform inputlookup on KV Store, then apply search filter to get data only falling in the recent required time. Finally perform outputlookup to the same KV Store to keep only required results.

You can then save the search as Scheduled Report to perform this on a regular basis.

If you can not figure out the query and need further help from the community members, you can add further details like KV Store name, and name of the fields along with sample data. Also what is the criteria for Date Range to drop events from KV Store? Is you timestamp field String Date or Epoch Date?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

splunkrocks2014
Communicator

I was thinking the way you described, but it doesn't work.

0 Karma

Inputlookup and search should work. May I know if the issue is with outputlookup? Are you seeing any error in Job Inspector/Splunk _internal logs?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...