Getting Data In

Delete old hosts from web interface (all indexed data)

mudricd
Explorer

Hi,

How can I delete old hosts from web interface (all indexed data) in search window?

Thanks in advance

Tags (2)

jrodman
Splunk Employee
Splunk Employee

In 4.1.6 and later, the summary dashboard filters out zero-count entries in hosts, sourcetypes. If you are performing searches against the metadata procesor, you can do the same with ... |search totalCount >0 | ...

Dan
Splunk Employee
Splunk Employee

You can use the delete command to hide the events. Currently there is a bug where the delete command doesn't seem to clear the metadata, so the old host values might still show up in the all indexed data panel although you won't be able to search for any events.

Keep in mind the delete command is restricted, and by default even the admin user doesn't have rights to execute it. You have to go to manager -> authorization -> roles to add the capability.

Dan
Splunk Employee
Splunk Employee

Thats the bug I mentioned. Its referenced in the Known Issues page here: http://www.splunk.com/base/Documentation/4.1.5/ReleaseNotes/Knownissues
"Deleting events via the delete operator does not seem to work. (SPL-30499, SPL-30468)"

0 Karma

mudricd
Explorer

I have already try with delete and now next to my host (name localhost) i have 0 events. Is there any way to delete it from dashboard i don't wont to have inactive host next to active.

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...