First, delete doesn't delete, just makes events non-searchable. Second, if you really really want to clean an index, you can, but it cleans the entire thing, not just the hosts you want to hide. Third, eventually, the index "bucket" containing that host and its data (which is made non-searchable by the delete command) will rotate out due to size or time constraints and the problem will correct itself. Fourth, if you can't wait for the bucket to age out, then you can tweak the dashboards to avoid the host. The unix app uses the | metadata search command to identify the hosts to show in the pulldown. You could edit the view in question to change the search a little bit so that the rows (hosts) from the metadata command which have totalCount=0 are filtered out. The search string would look like: | metadata type=hosts index=os | search totalCount!=0 This will mean that any host which has its events removed from search with the | delete search command will not show up in any of the pulldowns. You'll have to modify most of the views in the Unix app in this way, but it'll persist through upgrades. ... View more