Remove a host from hosts list in *nix app gui

[dearimranz]

I had some forwarders sending data to a splunk server with default configuration on the forwarders. Later I changed the configuration regarding hostnames and sourcetypes etc. I removed the data from splunk server using

| delete

command, all the data gets removed but old hostname still stays in *nix app in the hosts list with zero events.

How do I remove zero event hosts from *nix app hosts list?

[sowings]

First, delete doesn't delete, just makes events non-searchable.

Second, if you really really want to clean an index, you can, but it cleans the entire thing, not just the hosts you want to hide.

Third, eventually, the index "bucket" containing that host and its data (which is made non-searchable by the delete command) will rotate out due to size or time constraints and the problem will correct itself.

Fourth, if you can't wait for the bucket to age out, then you can tweak the dashboards to avoid the host. The unix app uses the | metadata search command to identify the hosts to show in the pulldown. You could edit the view in question to change the search a little bit so that the rows (hosts) from the metadata command which have totalCount=0 are filtered out. The search string would look like:


| metadata type=hosts index=os | search totalCount!=0


This will mean that any host which has its events removed from search with the | delete search command will not show up in any of the pulldowns. You'll have to modify most of the views in the Unix app in this way, but it'll persist through upgrades.

[andreamaral]

I have the same problem. I tried through transforms.conf and props.conf inside the apps Unix without success.