How do i delete host, sourcetype and source from splunk..
have tried following option,i am able to remove index but i want to delete host, sourcetype and source from the home page(dashboard)
*host="Vaibhav-PC" | delete
sourcetype="IIS" | delete
source="C:\Users\Administrator\Desktop\W3SVC2.zip:.\u_ex120227.log" | delete*
after removing have restarted splunk,but no sucess
Thanks,
Hi vaibhavbeohar
| delete
does not delete data, it marks it as unsearchable so it will not appear again in any search. If you want to delete indexed data you can read the docs and proceed like described.
cheers