Knowledge Management

How do I remove duplicate stale hosts from Data Summary?

splunktrainingu
Communicator

The problem is that I have duplicate hosts under the Data Summary. I can see that some of them were last seen may 13 I know that because at one point 4 hosts where sending their data to index=main. But now the issue is when I corrected the index for them to send to it created duplicate hosts that stopped sending to main. How do I remove the stale hosts and will this affect the data?

0 Karma

PavelP
Motivator

Hello @splunktraininguser12

you can delete data that you don't need anymore from the main index with delete(replace duplicate_host as appropriate):

  • first, check that the search list events which you want to delete, so you not delete events you need:

    index=main host=duplicate_host

  • second, use delete to remove these events from consequent searches. The events are still in the index, but will not be shown anymore. You need to modify your permissions to add the "can_delete" capability (Settings > Users > edit [user] > assign roles)

    index=main host=duplicate_host |delete
    After you deleted these events, they would not be shown unter the Data Summary.

Check this documentation for more information: https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/RemovedatafromSplunk

0 Karma

splunktrainingu
Communicator

Could not find the events even searched my the date they were last seen in main. nothing comes up when searching by host.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...