topic Re: How do i delete splunk forwarder hosts in Deployment Architecture

How do i delete splunk forwarder hosts

kvsajay213 — Tue, 25 Feb 2014 16:50:37 GMT

Hi,

I tried to uninstall splunkuniversalforwarder on Host server but still able to see Hosts in my splunk server can someone help me how to remove hosts?

Thanks in Advance

Re: How do i delete splunk forwarder hosts

linu1988 — Tue, 25 Feb 2014 19:49:33 GMT

Hello,
You will not be able to delete the host from the splunk server(Search head). It is already written to the metadata of the index present. If you don't require the data associated with the host you may need to delete the index and re-create it again. You will not see the host again. If you still have some important data then better filter out in queries using NOT or where clause for that host.

You may also take help of collect command to gather the necessary data into another index and save the data from getting deleted.

Thanks

Re: How do i delete splunk forwarder hosts

kvsajay213 — Tue, 25 Feb 2014 20:02:47 GMT

Thank you Abhisek....

I have uninstalled and installed universal forwarder and i am not able to see all the folders/logs like i can see in another server do you know why?

Re: How do i delete splunk forwarder hosts

linu1988 — Tue, 25 Feb 2014 20:14:47 GMT

which folder/logs are you referring to? is it a universal or heavy forwarder?

Re: How do i delete splunk forwarder hosts

kvsajay213 — Tue, 25 Feb 2014 20:21:44 GMT

Its Universal Installer

Re: How do i delete splunk forwarder hosts

kvsajay213 — Tue, 25 Feb 2014 20:39:42 GMT

Its Universal forwarder

Re: How do i delete splunk forwarder hosts

linu1988 — Wed, 26 Feb 2014 17:54:28 GMT

As i have mentioned in the answer you need to delete the index and re-create it then you will be able to host name from the index