I'm trying to delete kvstore collection using REST API via Python:
url = "https://localhost:8089/servicesNS/nobody/myapp/storage/collections/config/deleteme"
request = urllib2.Request(url, headers = {"Authorization" : "Splunk "})
request.get_method = lambda: "DELETE"
results = urllib2.urlopen(request)
This returns HTTP Error 400: Bad request.
The code works for other kvstore functions (when changing the URL) such as deleting collection's data, and I used the correct URL according to the documentation so I can't figure out why this doesn't work.
I cannot delete either. I get an error:
curl -k -s -u admin:changeme https://localhost:8089/servicesNS/nobody/myapp/storage/collections/config/test_collection_collection -X DELETE
<msg type="ERROR">Object id=test_collection_collection cannot be deleted in config=collections.</msg>
i found this frustrating too. you actually have to POST
the option as shown in the CURL examples in the docs.
the way i do it is using splunk's rest.simpleRequest method. strangely, i always seem to misplace the link for the SDK, but here's an example:
http://answers.splunk.com/answers/144000/modifying-acl-saved-search-permissions-through-rest-api-usi...
it's not ideal - but perhaps you could first retrieve all the data points in that collection, and then iteratively delete them?
query_uri = '/servicesNS/nobody/<app>/storage/collections/data/<kvstore>'
serverResponse, serverContent = rest.simpleRequest(query_uri, sessionKey=sessionKey)
for result in serverContent:
removal_uri = '/servicesNS/nobody/<app>/storage/collections/data/<kvstore>/%s' % result['_key']
serverResponse, serverContent = rest.simpleRequest(removal_uri, sessionKey=sessionKey, method='DELETE')
maybe you can also leverage one of the answers from my similar question:
https://answers.splunk.com/answers/237859/can-i-delete-all-data-from-a-kv-store-at-once.html
What happens if you make the same request using curl? Also, likely there is some output together with the 400 status code - can you post it here?