All Apps and Add-ons

Purging dead host data

New Member

When users are terminated or have to swap out workstations, the old workstations are reimaged. I can remove these from my Qualys subscription, but hosts that have been gone for over a year are still populating my Qualys Splunk App dashboards. Is there a way to remove/disregard this data from these dead hosts so they aren't clogging up my metrics?

0 Karma

Communicator

Hi @bdpummer,

The Qualys TA does not support data deletion. However, if you know the purged host ids, you can use Splunk's delete command. It will stop those records from appearing in subsequent searches. But be aware that, the delete command does not reclaim the disk space.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!