Splunk Enterprise Security

How to bulk delete multiple host from Splunk not data

pavi_pavi_p
Engager

Hello Experts,

Good Morning,

How to bulk delete multiple host from Splunk not data. Kindly help with the query.

Thanks
Pavi

0 Karma

inventsekar
Ultra Champion

"Splunk not data" means, the hosts that are not sent any data?
you can remove the bulk hosts from the serverClass.conf file, so that inputs file wont be deployed to these bulk hosts. but still these hosts would be sending the logs as per their existing inputs file.

i am not sure of this idea - if we blacklist a host which was whitelisted earlier, then, will the host still be sending the logs or not? need to verify this.

0 Karma

pavi_pavi_p
Engager

Hello Sekar,

Thanks for your response.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk.

0 Karma

pavi_pavi_p
Engager

Help with the SPL Query to delete bulk host list!

0 Karma

pavi_pavi_p
Engager

I know how to delete single host from Splunk.

Ex : Host=hostname or ipaddress | delete.

looking SPL query for bulk host deletion.

0 Karma

inventsekar
Ultra Champion

Host=hostname or ipaddress | delete
this will delete the logs from the host.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk
To deploy a new deployment server, i am not sure why you want to bulk delete hosts.
kindly update us clearly about the situation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...