Delete old hosts from web interface (all indexed data)

[mudricd]

Hi,

How can I delete old hosts from web interface (all indexed data) in search window?

Thanks in advance

[jrodman]

In 4.1.6 and later, the summary dashboard filters out zero-count entries in hosts, sourcetypes. If you are performing searches against the metadata procesor, you can do the same with ... |search totalCount >0 | ...

[Dan]

You can use the delete command to hide the events. Currently there is a bug where the delete command doesn't seem to clear the metadata, so the old host values might still show up in the all indexed data panel although you won't be able to search for any events.

Keep in mind the delete command is restricted, and by default even the admin user doesn't have rights to execute it. You have to go to manager -> authorization -> roles to add the capability.

[Dan]

Thats the bug I mentioned. Its referenced in the Known Issues page here: http://www.splunk.com/base/Documentation/4.1.5/ReleaseNotes/Knownissues
"Deleting events via the delete operator does not seem to work. (SPL-30499, SPL-30468)"

[mudricd]

I have already try with delete and now next to my host (name localhost) i have 0 events. Is there any way to delete it from dashboard i don't wont to have inactive host next to active.

Thanks