- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: How do i delete splunk forwarder hosts
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do i delete splunk forwarder hosts
Hi,
I tried to uninstall splunkuniversalforwarder on Host server but still able to see Hosts in my splunk server can someone help me how to remove hosts?
Thanks in Advance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Its Universal forwarder
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
which folder/logs are you referring to? is it a universal or heavy forwarder?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Abhisek....
I have uninstalled and installed universal forwarder and i am not able to see all the folders/logs like i can see in another server do you know why?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
You will not be able to delete the host from the splunk server(Search head). It is already written to the metadata of the index present. If you don't require the data associated with the host you may need to delete the index and re-create it again. You will not see the host again. If you still have some important data then better filter out in queries using NOT or where clause for that host.
You may also take help of collect command to gather the necessary data into another index and save the data from getting deleted.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As i have mentioned in the answer you need to delete the index and re-create it then you will be able to host name from the index
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Its Universal Installer
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
