Getting Data In

Delete old hosts from web interface (all indexed data)

mudricd
Explorer

Hi,

How can I delete old hosts from web interface (all indexed data) in search window?

Thanks in advance

Tags (2)

jrodman
Splunk Employee
Splunk Employee

In 4.1.6 and later, the summary dashboard filters out zero-count entries in hosts, sourcetypes. If you are performing searches against the metadata procesor, you can do the same with ... |search totalCount >0 | ...

Dan
Splunk Employee
Splunk Employee

You can use the delete command to hide the events. Currently there is a bug where the delete command doesn't seem to clear the metadata, so the old host values might still show up in the all indexed data panel although you won't be able to search for any events.

Keep in mind the delete command is restricted, and by default even the admin user doesn't have rights to execute it. You have to go to manager -> authorization -> roles to add the capability.

Dan
Splunk Employee
Splunk Employee

Thats the bug I mentioned. Its referenced in the Known Issues page here: http://www.splunk.com/base/Documentation/4.1.5/ReleaseNotes/Knownissues
"Deleting events via the delete operator does not seem to work. (SPL-30499, SPL-30468)"

0 Karma

mudricd
Explorer

I have already try with delete and now next to my host (name localhost) i have 0 events. Is there any way to delete it from dashboard i don't wont to have inactive host next to active.

Thanks

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.