"how to cancel the data source"

[johnsmithcy]

the host monitoring keep fetching the CPU data.
I want to cancel the date source

[MoniM]

Hi @johnsmithcy,

you can use the below command in CLI:-

sourcetype=my_sourcetype | delete
For more details check this http://www.splunk.com/base/Documentation/4.1.1/Admin/RemovedatafromSplunk

[johnsmithcy]

thank you. any graphical interface method?
I am using windows version

[MoniM]

Okay, so you can delete your sourcetype by following below steps:-
1. login to your splunk instance and goto settings
2. In data, goto sourcetypes and search for your sorectype(which you created for your "CPU" input).
3. delete that sourcetype.

Let me know if it works.

[johnsmithcy]

it works, thx

[dkeck · Accepted solution]

Hi,

depending from where you are getting your data you just have to disable the stanza in inputs.conf on your forwarder to stop it from sending.

[johnsmithcy]

i configure it through "add data"--> "monitor" --> local performance monitoring

[dkeck]

Then try to find it under settings-> data inputs -> local Windows or local perfomance monitoring 🙂 than click delete or disable