Delete data in a KV Store collection

Manually delete bulk data that exceeds a specific time threshold using an SPL search.

Note: Deleting data from a KV Store collection is a temporary solution, since the KV Store collection might get populated again with new data unless the saved searches that write to it are turned off or modified.

.

Use the following example SPL search to completely delete a KV Store collection:

| outputlookup <collection-name> append=F

Use the following example SPL search to to keep a subset of the KV Store collection based on a specific condition:

| inputlookup <collection-name> | where <condition for data to keep> | outputlookup <collection-name> append=F

For more information on using lookup command, see lookup.