"| delete" after lookup command

[HeinzWaescher]

Hi,

is it possible to use the delete command after a lookup?

 sourcetype=sourceA
 | lookup delete_lookup.csv key OUTPUT flag
 | search flag="delete"
 | delete

Running this kind of search results in the warning "events could not be deleted".

Thanks for your help
Heinz

[somesoni2]

SOmething like this worked for me.

Lookup search

index=_internal earliest=-1d@d latest=@d| stats count as past by sourcetype | outputlookup internalsourcetypepast.csv

Delete search

index=_internal earliest=@d| lookup internalsourcetypepast.csv sourcetype | where past<100 | delete

[HeinzWaescher]

Hm, today it works for me as well. Thanks 🙂