https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440974#M20766 <P>This is sort of a test system. Where would I use the delete command? How do I disable inputs?</P> Thu, 07 Jun 2018 19:33:16 GMT rogue_carrot 2018-06-07T19:33:16Z https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440970#M20762 <P>Hello Team,</P> <P>Can someone help me figure out how to delete a data source? I went over the limit for the 500MB a day with the free license and would like to remove a couple of data sources to make sure I stay within the daily quota. The screenshot below shows one data source I would like to remove from indexing. I did search Google for ways to do this but did not find anything. Thanks for reading this.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="Data Summary screen shot"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5142i3A2A1633ECD94844/image-size/large?v=v2&amp;px=999" role="button" title="Data Summary screen shot" alt="Data Summary screen shot" /></span></P> <P>Regards,</P> <P>rogue carrot</P> Thu, 07 Jun 2018 17:55:04 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440970#M20762 rogue_carrot 2018-06-07T17:55:04Z https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440971#M20763 <P>@rogue_carrot Check the Data Source/Sourcetype from the Host. Since it is the local loopback address. Seems like it is coming from your Splunk Server (indexer) itself. Check the sourcetype and remoce it from server. </P> Thu, 07 Jun 2018 18:00:35 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440971#M20763 niketn 2018-06-07T18:00:35Z https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440972#M20764 <P>Yes this is from the localhost. Do you have a list of steps I can take to delete this from being indexed?</P> Thu, 07 Jun 2018 18:02:02 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440972#M20764 rogue_carrot 2018-06-07T18:02:02Z https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440973#M20765 <P>Is this a test system? If so, you may try the delete command. Be careful though. You also want to disable the input once you find it.</P> Thu, 07 Jun 2018 19:23:15 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440973#M20765 nswondem 2018-06-07T19:23:15Z https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440974#M20766 <P>This is sort of a test system. Where would I use the delete command? How do I disable inputs?</P> Thu, 07 Jun 2018 19:33:16 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440974#M20766 rogue_carrot 2018-06-07T19:33:16Z https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440975#M20767 <P>Check the host index/sourcetype.If it is internal data,then that host is not the reason for violation.</P> <P>And if you still want not to index,then you have an option to send data from 127..... host to null queue:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad</A></P> <P>And regarding delete command,if the indexed data is internal for that host then no affect of deleting events.Find the doc for delete command</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Delete">https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Delete</A></P> Fri, 08 Jun 2018 11:02:45 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-remove-something-from-being-indexed/m-p/440975#M20767 ansif 2018-06-08T11:02:45Z