https://community.splunk.com/t5/Getting-Data-In/deleting-misconfigured-hosts/m-p/535407#M89796 <P>Indexed data cannot be changed, removed, modified, deleted, or edited.&nbsp; You may (if you have permission) be able to use the <FONT face="courier new,courier">| delete</FONT> command to <STRONG>hide</STRONG> unwanted events, but you're stuck with them until they age out of the index.</P> Mon, 11 Jan 2021 22:11:30 GMT richgalloway 2021-01-11T22:11:30Z https://community.splunk.com/t5/Getting-Data-In/deleting-misconfigured-hosts/m-p/535403#M89795 <P>Hey guys I've been having trouble finding documentation about removing indexed data.</P><P>After looking through the "meta woot!" app I saw my hosts were growing a few thousand a day and my estreamer app was logging all .log files as new hosts. I have fixed the logging issue by changing the monitoring string and host segment portion in the .conf file but now looking to remove the .logs file from the host field.</P><P>Has anyone ever had an issue like this and know a fix or can point me into the right direction thanks.</P> Mon, 11 Jan 2021 21:04:47 GMT https://community.splunk.com/t5/Getting-Data-In/deleting-misconfigured-hosts/m-p/535403#M89795 splunk_user4 2021-01-11T21:04:47Z https://community.splunk.com/t5/Getting-Data-In/deleting-misconfigured-hosts/m-p/535407#M89796 <P>Indexed data cannot be changed, removed, modified, deleted, or edited.&nbsp; You may (if you have permission) be able to use the <FONT face="courier new,courier">| delete</FONT> command to <STRONG>hide</STRONG> unwanted events, but you're stuck with them until they age out of the index.</P> Mon, 11 Jan 2021 22:11:30 GMT https://community.splunk.com/t5/Getting-Data-In/deleting-misconfigured-hosts/m-p/535407#M89796 richgalloway 2021-01-11T22:11:30Z