Getting Data In
Highlighted

Delete old hosts from web interface (all indexed data)

Explorer

Hi,

How can I delete old hosts from web interface (all indexed data) in search window?

Thanks in advance

Tags (2)
Highlighted

Re: Delete old hosts from web interface (all indexed data)

Splunk Employee
Splunk Employee

You can use the delete command to hide the events. Currently there is a bug where the delete command doesn't seem to clear the metadata, so the old host values might still show up in the all indexed data panel although you won't be able to search for any events.

Keep in mind the delete command is restricted, and by default even the admin user doesn't have rights to execute it. You have to go to manager -> authorization -> roles to add the capability.

Highlighted

Re: Delete old hosts from web interface (all indexed data)

Explorer

I have already try with delete and now next to my host (name localhost) i have 0 events. Is there any way to delete it from dashboard i don't wont to have inactive host next to active.

Thanks

0 Karma
Highlighted

Re: Delete old hosts from web interface (all indexed data)

Splunk Employee
Splunk Employee

Thats the bug I mentioned. Its referenced in the Known Issues page here: http://www.splunk.com/base/Documentation/4.1.5/ReleaseNotes/Knownissues
"Deleting events via the delete operator does not seem to work. (SPL-30499, SPL-30468)"

0 Karma
Highlighted

Re: Delete old hosts from web interface (all indexed data)

Splunk Employee
Splunk Employee

In 4.1.6 and later, the summary dashboard filters out zero-count entries in hosts, sourcetypes. If you are performing searches against the metadata procesor, you can do the same with ... |search totalCount >0 | ...