How do i delete splunk forwarder hosts

[kvsajay213]

Hi,

I tried to uninstall splunkuniversalforwarder on Host server but still able to see Hosts in my splunk server can someone help me how to remove hosts?

Thanks in Advance

[kvsajay213]

Its Universal forwarder

[linu1988]

which folder/logs are you referring to? is it a universal or heavy forwarder?

[kvsajay213]

Thank you Abhisek....

I have uninstalled and installed universal forwarder and i am not able to see all the folders/logs like i can see in another server do you know why?

[linu1988]

Hello,
You will not be able to delete the host from the splunk server(Search head). It is already written to the metadata of the index present. If you don't require the data associated with the host you may need to delete the index and re-create it again. You will not see the host again. If you still have some important data then better filter out in queries using NOT or where clause for that host.

You may also take help of collect command to gather the necessary data into another index and save the data from getting deleted.

Thanks

[linu1988]

As i have mentioned in the answer you need to delete the index and re-create it then you will be able to host name from the index

[kvsajay213]

Its Universal Installer