Archive

How do i delete splunk forwarder hosts

New Member

Hi,

I tried to uninstall splunkuniversalforwarder on Host server but still able to see Hosts in my splunk server can someone help me how to remove hosts?

Thanks in Advance

Tags (1)
0 Karma

New Member

Its Universal forwarder

0 Karma

Champion

which folder/logs are you referring to? is it a universal or heavy forwarder?

0 Karma

New Member

Thank you Abhisek....

I have uninstalled and installed universal forwarder and i am not able to see all the folders/logs like i can see in another server do you know why?

0 Karma

Champion

Hello,
You will not be able to delete the host from the splunk server(Search head). It is already written to the metadata of the index present. If you don't require the data associated with the host you may need to delete the index and re-create it again. You will not see the host again. If you still have some important data then better filter out in queries using NOT or where clause for that host.

You may also take help of collect command to gather the necessary data into another index and save the data from getting deleted.

Thanks

0 Karma

Champion

As i have mentioned in the answer you need to delete the index and re-create it then you will be able to host name from the index

0 Karma

New Member

Its Universal Installer

0 Karma