Splunk Enterprise Security

How to bulk delete multiple host from Splunk not data

pavi_pavi_p
Engager

Hello Experts,

Good Morning,

How to bulk delete multiple host from Splunk not data. Kindly help with the query.

Thanks
Pavi

0 Karma

inventsekar
SplunkTrust
SplunkTrust

"Splunk not data" means, the hosts that are not sent any data?
you can remove the bulk hosts from the serverClass.conf file, so that inputs file wont be deployed to these bulk hosts. but still these hosts would be sending the logs as per their existing inputs file.

i am not sure of this idea - if we blacklist a host which was whitelisted earlier, then, will the host still be sending the logs or not? need to verify this.

0 Karma

pavi_pavi_p
Engager

Hello Sekar,

Thanks for your response.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk.

0 Karma

pavi_pavi_p
Engager

Help with the SPL Query to delete bulk host list!

0 Karma

pavi_pavi_p
Engager

I know how to delete single host from Splunk.

Ex : Host=hostname or ipaddress | delete.

looking SPL query for bulk host deletion.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Host=hostname or ipaddress | delete
this will delete the logs from the host.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk
To deploy a new deployment server, i am not sure why you want to bulk delete hosts.
kindly update us clearly about the situation.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...