How to bulk delete multiple host from Splunk not data

[pavi_pavi_p]

Hello Experts,

Good Morning,

How to bulk delete multiple host from Splunk not data. Kindly help with the query.

Thanks
Pavi

[inventsekar]

"Splunk not data" means, the hosts that are not sent any data?
you can remove the bulk hosts from the serverClass.conf file, so that inputs file wont be deployed to these bulk hosts. but still these hosts would be sending the logs as per their existing inputs file.

i am not sure of this idea - if we blacklist a host which was whitelisted earlier, then, will the host still be sending the logs or not? need to verify this.

[pavi_pavi_p]

Hello Sekar,

Thanks for your response.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk.

[pavi_pavi_p]

Help with the SPL Query to delete bulk host list!

[pavi_pavi_p]

I know how to delete single host from Splunk.

Ex : Host=hostname or ipaddress | delete.

looking SPL query for bulk host deletion.

[inventsekar]

Host=hostname or ipaddress | delete
this will delete the logs from the host.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk
To deploy a new deployment server, i am not sure why you want to bulk delete hosts.
kindly update us clearly about the situation.