https://community.splunk.com/t5/Deployment-Architecture/How-to-sync-data-between-two-splunk-servers/m-p/239240#M23886 <P>I have few questions regarding splunk server data.<BR /> 1. where does data is stored in splunk server, I am using universal forwarder to send the data to splunk.<BR /> 2. How can i delete the data based on hostname. I want to delete all data based on the hostname<BR /> 3. How can i sync the data between two splunk servers.</P> Thu, 05 May 2016 10:35:25 GMT sureshsala 2016-05-05T10:35:25Z https://community.splunk.com/t5/Deployment-Architecture/How-to-sync-data-between-two-splunk-servers/m-p/239240#M23886 <P>I have few questions regarding splunk server data.<BR /> 1. where does data is stored in splunk server, I am using universal forwarder to send the data to splunk.<BR /> 2. How can i delete the data based on hostname. I want to delete all data based on the hostname<BR /> 3. How can i sync the data between two splunk servers.</P> Thu, 05 May 2016 10:35:25 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-sync-data-between-two-splunk-servers/m-p/239240#M23886 sureshsala 2016-05-05T10:35:25Z https://community.splunk.com/t5/Deployment-Architecture/How-to-sync-data-between-two-splunk-servers/m-p/239241#M23887 <P>1: On your indexers, check here:</P> <PRE><CODE>$SPLUNK_HOME/etc/system/{default|local}/indexes.conf </CODE></PRE> <P>2: As far as hiding events from all further searches, like this:</P> <PRE><CODE>My Search Details Here host=MyHostToDelete | delete </CODE></PRE> <P>3: You can set up an indexer cluster with help here:</P> <PRE><CODE><A href="http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Clusterdeploymentoverview" target="test_blank">http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Clusterdeploymentoverview</A> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters" target="test_blank">http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters</A> </CODE></PRE> Thu, 05 May 2016 14:51:58 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-sync-data-between-two-splunk-servers/m-p/239241#M23887 woodcock 2016-05-05T14:51:58Z