topic Re: Delete old hosts from web interface (all indexed data) in Getting Data In

Delete old hosts from web interface (all indexed data)

mudricd — Sun, 10 Oct 2010 03:27:30 GMT

Hi,

How can I delete old hosts from web interface (all indexed data) in search window?

Thanks in advance

Re: Delete old hosts from web interface (all indexed data)

Dan — Mon, 11 Oct 2010 23:19:26 GMT

You can use the delete command to hide the events. Currently there is a bug where the delete command doesn't seem to clear the metadata, so the old host values might still show up in the all indexed data panel although you won't be able to search for any events.

Keep in mind the delete command is restricted, and by default even the admin user doesn't have rights to execute it. You have to go to manager -> authorization -> roles to add the capability.

Re: Delete old hosts from web interface (all indexed data)

mudricd — Tue, 12 Oct 2010 16:15:51 GMT

I have already try with delete and now next to my host (name localhost) i have 0 events. Is there any way to delete it from dashboard i don't wont to have inactive host next to active.

Thanks

Re: Delete old hosts from web interface (all indexed data)

Dan — Wed, 13 Oct 2010 19:33:40 GMT

Thats the bug I mentioned. Its referenced in the Known Issues page here: http://www.splunk.com/base/Documentation/4.1.5/ReleaseNotes/Knownissues
"Deleting events via the delete operator does not seem to work. (SPL-30499, SPL-30468)"

Re: Delete old hosts from web interface (all indexed data)

jrodman — Thu, 03 Mar 2011 06:13:25 GMT

In 4.1.6 and later, the summary dashboard filters out zero-count entries in hosts, sourcetypes. If you are performing searches against the metadata procesor, you can do the same with ... |search totalCount >0 | ...