Indexed data isn't for changing, so you cannot fully delete data based on some host, or change the sourcetype value for some host.
You can empty an entire index, run this while splunk is stopped:$SPLUNK_HOME/bin/splunk clean eventdata -index yourindex
You can mark individual events as deleted without cleaning up space, append the delete command to a search to mark the results as deleted - your user needs the can_delete role to be allowed to.
To alleviate the impact of wrong indexing in the future, consider creating a sandbox index to first send data into, confirm its correct, and only then send data into your actual indexes.
