We have an asset database that keeps track of decommissioned assets. We can make a table of all decommissioned assets in our environment. Is there a way to use the REST API to remove those assets from the deployment server.
Something like:
"Status="end of life"| foreach AssetName rest DELETE https://localhost:8089/services/deployment/server/clients/AssetName"
You could install an app like https://splunkbase.splunk.com/app/4146/ and use the | curl method=delete option, it will involve a few tricks and most likely you would want a | map to run the curl command many times.
You might need to apply this fix if installing version 1.2.3 for the TA webtools.
You have the right idea, but POST and DELETE operations cannot be performed from a search. You'll have to write a script that reads your list of decommissioned assets and sends the REST commands to Splunk using curl or similar.