Purging dead host data

[bdpummer]

When users are terminated or have to swap out workstations, the old workstations are reimaged. I can remove these from my Qualys subscription, but hosts that have been gone for over a year are still populating my Qualys Splunk App dashboards. Is there a way to remove/disregard this data from these dead hosts so they aren't clogging up my metrics?

[prabhasgupte]

Hi @bdpummer,

The Qualys TA does not support data deletion. However, if you know the purged host ids, you can use Splunk's delete command. It will stop those records from appearing in subsequent searches. But be aware that, the delete command does not reclaim the disk space.