Knowledge Management

How do I add and delete host in Data Summary from Data Summary Splunk?

bogdan_nicolesc
Communicator

Hi there. Newbie on splunk here.

I have a rookie question to ask ...

In Search menu, under Data Summary, how do I add Host?

I have discovered how to delete one, but not how to add.

Thank you to anyone reply this question.

0 Karma
1 Solution

bogdan_nicolesc
Communicator

I've got my answer!

The answer is: If you index a new data type/source/host, you must index it in default index. You cannot create new index.

Now i have new question: why if i choose to create new index, my host/sourcetype/source is not appearing under data summary?

Thank you.

View solution in original post

0 Karma

bogdan_nicolesc
Communicator

I've got my answer!

The answer is: If you index a new data type/source/host, you must index it in default index. You cannot create new index.

Now i have new question: why if i choose to create new index, my host/sourcetype/source is not appearing under data summary?

Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@bogdan_nicolescu If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

The data summary is summarizing all of the distinct host, source, and sourcetype values in the currently searchable data in Splunk. It is dynamically picking up new values for those metadata fields as data comes in.

somesoni2
SplunkTrust
SplunkTrust

As soon as you start indexing data with your host (with metadata field host=yourServerName), it would show up automatically.

0 Karma

bogdan_nicolesc
Communicator

Also, to delete index you have to go: Settings -> Data -> Indexes and there you can manage your indexes.

For data inpots you have to go to Settings -> Data Inputs -> Files & Directories.

0 Karma

bogdan_nicolesc
Communicator

Yes, but what is THE process to do just that?

In Search and Reporting, Data Summary i have had under Hosts, 2 hosts. One of which i have deleted it.

And questions was: How do i EXACTLY do just that? How EXACTLY do i add an HOST under there?

Step by step procedure please.

Thank you.
Have a nice day.

0 Karma

sudosplunk
Motivator

Hi there,

How did you delete the host?

0 Karma

bogdan_nicolesc
Communicator

Hi,

You need to create an account with delete rights, Data summary, select data type, in search then select all time and in search bar where is "somedatabasetype=somesource" you need to type after that "| delete" as in: "somedatabasetype=somesource | delete" and search. And after that you have deleted it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...