All Apps and Add-ons

Remove a host from hosts list in *nix app gui

dearimranz
Engager

I had some forwarders sending data to a splunk server with default configuration on the forwarders. Later I changed the configuration regarding hostnames and sourcetypes etc. I removed the data from splunk server using

| delete

command, all the data gets removed but old hostname still stays in *nix app in the hosts list with zero events.

How do I remove zero event hosts from *nix app hosts list?

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

First, delete doesn't delete, just makes events non-searchable.

Second, if you really really want to clean an index, you can, but it cleans the entire thing, not just the hosts you want to hide.

Third, eventually, the index "bucket" containing that host and its data (which is made non-searchable by the delete command) will rotate out due to size or time constraints and the problem will correct itself.

Fourth, if you can't wait for the bucket to age out, then you can tweak the dashboards to avoid the host. The unix app uses the | metadata search command to identify the hosts to show in the pulldown. You could edit the view in question to change the search a little bit so that the rows (hosts) from the metadata command which have totalCount=0 are filtered out. The search string would look like:


| metadata type=hosts index=os | search totalCount!=0

This will mean that any host which has its events removed from search with the | delete search command will not show up in any of the pulldowns. You'll have to modify most of the views in the Unix app in this way, but it'll persist through upgrades.

andreamaral
New Member

I have the same problem. I tried through transforms.conf and props.conf inside the apps Unix without success.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...