.drop all metadata (Deprecated)
The .drop all metadata command deletes all Cribl Search metadata for the specified Datasets.
Deprecated Feature
Cribl is deprecating this feature in preparation for a different solution. We’ll remove it in a future release.
Please continue to report issues through normal Cribl support channels, but assistance for deprecated features might be limited.
// drop metadata from the cribl_search_sample Dataset
.drop all metadata(cribl_search_sample)Purpose
Use .drop all metadata to delete Cribl Search metadata generated by
.generate metadata or Dataset Acceleration.
You can use .drop all metadata with the following Dataset Provider types:
- Cribl Lake
- Amazon S3
- Azure Blob Storage
- Google Cloud Storage
- Amazon Security Lake (only in the Quick mode)
To see which Datasets contain Cribl Search metadata, run
dataset=$vt_object_list_summary.
Permissions
| Search Member Type | Permissions |
|---|---|
| Admin | Can drop metadata from all Datasets in their Organization. |
| Editor | Can drop metadata only from those Datasets that they created themselves or that were shared with them. |
| User | Can drop metadata only from those Datasets that were shared with them. |
Syntax
.drop all metadata(DatasetID[, ...]) [with(reason = "InvestigationReason")]
You can also combine this command with operators.
Parameters
| Parameter | Type | Description |
|---|---|---|
DatasetID | string | The ID of the Dataset that you want to clear of metadata. Separate multiple IDs with a comma ,. Wildcards * are not supported. |
InvestigationReason | string | The reason for running the .drop all metadata command, which is added to the Cribl Search audit log. |
Returns
Returns an event per each processed Dataset, with the following fields:
| Field | Description |
|---|---|
success | true if the metadata was successfully deleted, false otherwise. |
dataset | The ID of the Dataset that was cleared of metadata. |
datasetType | The type of the Dataset that was cleared of metadata. |
message | A success or error message. |
Examples
Drop Cribl Search metadata from the cribl_search_sample Dataset.
.drop all metadata(cribl_search_sample) with(reason = "I don't need this metadata anymore.")