Knowledge Management

How do I remove duplicate stale hosts from Data Summary?


The problem is that I have duplicate hosts under the Data Summary. I can see that some of them were last seen may 13 I know that because at one point 4 hosts where sending their data to index=main. But now the issue is when I corrected the index for them to send to it created duplicate hosts that stopped sending to main. How do I remove the stale hosts and will this affect the data?

0 Karma


Hello @splunktraininguser12

you can delete data that you don't need anymore from the main index with delete(replace duplicate_host as appropriate):

  • first, check that the search list events which you want to delete, so you not delete events you need:

    index=main host=duplicate_host

  • second, use delete to remove these events from consequent searches. The events are still in the index, but will not be shown anymore. You need to modify your permissions to add the "can_delete" capability (Settings > Users > edit [user] > assign roles)

    index=main host=duplicate_host |delete
    After you deleted these events, they would not be shown unter the Data Summary.

Check this documentation for more information:

0 Karma


Could not find the events even searched my the date they were last seen in main. nothing comes up when searching by host.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...