How do I remove duplicate stale hosts from Data Summary?

[splunktrainingu]

The problem is that I have duplicate hosts under the Data Summary. I can see that some of them were last seen may 13 I know that because at one point 4 hosts where sending their data to index=main. But now the issue is when I corrected the index for them to send to it created duplicate hosts that stopped sending to main. How do I remove the stale hosts and will this affect the data?

[PavelP]

Hello @splunktraininguser12

you can delete data that you don't need anymore from the main index with delete(replace duplicate_host as appropriate):

• first, check that the search list events which you want to delete, so you not delete events you need:

  index=main host=duplicate_host

• second, use delete to remove these events from consequent searches. The events are still in the index, but will not be shown anymore. You need to modify your permissions to add the "can_delete" capability (Settings > Users > edit [user] > assign roles)

  index=main host=duplicate_host |delete
  After you deleted these events, they would not be shown unter the Data Summary.

Check this documentation for more information: https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/RemovedatafromSplunk

[splunktrainingu]

Could not find the events even searched my the date they were last seen in main. nothing comes up when searching by host.