I know about "splunk clean eventdata ...", but I want to do this action from web-interface. It's very important feature with many devices, I think. And also, I want to give some names for my IP-hosts without DNS in Splunk. Will I ever see it? Please, developers...
Yes we can delete the data virtually i.e, the metadata will be deleted from Indexers so that the data can't be searchable.
Note: Your index size and events will remain same size as before along with buckets.
at the end of your query add 'by clause' with delete command
eg: if you have 110hosts and you want to see only 2hosts data,
index=xxxx_index NOT host=xxx_1 NOT host=xxx_2|delete