https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20159#M8413 <P>I have the same question! I cannot find a way to get rid of them...</P> Fri, 06 Aug 2010 20:27:47 GMT fribert 2010-08-06T20:27:47Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20157#M8411 <P>Hi ALL~</P> <P>How do I remove Sources from my 'Sources Indexed'?</P> <P>Thx.</P> Mon, 26 Jul 2010 13:11:48 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20157#M8411 howardhon 2010-07-26T13:11:48Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20158#M8412 <P>There are several options. The best approach depends on what you are ultimately trying to accomplish by removing them. Please add more detail.</P> Mon, 26 Jul 2010 21:06:16 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20158#M8412 bwooden 2010-07-26T21:06:16Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20159#M8413 <P>I have the same question! I cannot find a way to get rid of them...</P> Fri, 06 Aug 2010 20:27:47 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20159#M8413 fribert 2010-08-06T20:27:47Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20160#M8414 <P>Oh - I found it here: <A href="http://www.splunk.com/base/Documentation/latest/Admin/RemovedatafromSplunk" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/RemovedatafromSplunk</A></P> Fri, 06 Aug 2010 20:33:26 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20160#M8414 fribert 2010-08-06T20:33:26Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20161#M8415 <P>thx fribert ^___^</P> Mon, 16 Aug 2010 10:16:18 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20161#M8415 howardhon 2010-08-16T10:16:18Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20162#M8416 <P>Put the [| delete] after your specific source [source="zzzzzz" | delete] </P> <P>But you need to add can_delete role to your account before do above process</P> Fri, 03 Sep 2010 22:03:09 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20162#M8416 TheGU 2010-09-03T22:03:09Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20163#M8417 <P>unfortunately, | delete will not actually make the sources not show up. A bug makes it so the sources will still show up, but with a count of 0. (in the summary dashboard, that is)</P> <P>Again, it all depends on what you are trying to do, just like Bwooden said...</P> Sat, 13 Nov 2010 04:13:22 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20163#M8417 Genti 2010-11-13T04:13:22Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20164#M8418 <P>I am using splunk 5.0.2 and the above link does not apply for the latest version. How can I delete a source or sourcetype from the splunk server? The reason I want to delete the source/sourcetype is to reorganize my search dashboard. Currently I have configured the splunk universal forwarder to monitor glassfish logs (server.log file). With this configuration I see all the server.log* files transferred to the splunk server. I want them to be grouped them into one logical group since I have multiple instances and clusters configured on glassfish. How do I do that?</P> Thu, 18 Apr 2013 12:54:54 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20164#M8418 shahamit 2013-04-18T12:54:54Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20165#M8419 <P>Hi .. where to use this command, i have tried in search but it didnt work out</P> Tue, 15 Sep 2015 10:34:37 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-remove-Sources/m-p/20165#M8419 rupesh_patil20 2015-09-15T10:34:37Z