How do I remove duplicate stale hosts from Data Summary?


The problem is that I have duplicate hosts under the Data Summary. I can see that some of them were last seen may 13 I know that because at one point 4 hosts where sending their data to index=main. But now the issue is when I corrected the index for them to send to it created duplicate hosts that stopped sending to main. How do I remove the stale hosts and will this affect the data?

0 Karma


Hello @splunktraininguser12

you can delete data that you don't need anymore from the main index with delete(replace duplicate_host as appropriate):

  • first, check that the search list events which you want to delete, so you not delete events you need:

    index=main host=duplicate_host

  • second, use delete to remove these events from consequent searches. The events are still in the index, but will not be shown anymore. You need to modify your permissions to add the "can_delete" capability (Settings > Users > edit [user] > assign roles)

    index=main host=duplicate_host |delete
    After you deleted these events, they would not be shown unter the Data Summary.

Check this documentation for more information:

0 Karma


Could not find the events even searched my the date they were last seen in main. nothing comes up when searching by host.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!