topic Re: How to bulk delete multiple host from Splunk not data in Splunk Enterprise Security

How to bulk delete multiple host from Splunk not data

pavi_pavi_p — Thu, 17 Jan 2019 06:26:47 GMT

Hello Experts,

Good Morning,

How to bulk delete multiple host from Splunk not data. Kindly help with the query.

Thanks
Pavi

Re: How to bulk delete multiple host from Splunk not data

inventsekar — Thu, 17 Jan 2019 06:38:39 GMT

"Splunk not data" means, the hosts that are not sent any data?
you can remove the bulk hosts from the serverClass.conf file, so that inputs file wont be deployed to these bulk hosts. but still these hosts would be sending the logs as per their existing inputs file.

i am not sure of this idea - if we blacklist a host which was whitelisted earlier, then, will the host still be sending the logs or not? need to verify this.

Re: How to bulk delete multiple host from Splunk not data

pavi_pavi_p — Thu, 17 Jan 2019 06:54:04 GMT

Hello Sekar,

Thanks for your response.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk.

Re: How to bulk delete multiple host from Splunk not data

pavi_pavi_p — Thu, 17 Jan 2019 06:54:50 GMT

Help with the SPL Query to delete bulk host list!

Re: How to bulk delete multiple host from Splunk not data

pavi_pavi_p — Thu, 17 Jan 2019 06:58:23 GMT

I know how to delete single host from Splunk.

Ex : Host=hostname or ipaddress | delete.

looking SPL query for bulk host deletion.

Re: How to bulk delete multiple host from Splunk not data

inventsekar — Thu, 17 Jan 2019 07:27:22 GMT

Host=hostname or ipaddress | delete
this will delete the logs from the host.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk
To deploy a new deployment server, i am not sure why you want to bulk delete hosts.
kindly update us clearly about the situation.