Splunk Enterprise Security

How to bulk delete multiple host from Splunk not data

pavi_pavi_p
Engager

Hello Experts,

Good Morning,

How to bulk delete multiple host from Splunk not data. Kindly help with the query.

Thanks
Pavi

0 Karma

inventsekar
Super Champion

"Splunk not data" means, the hosts that are not sent any data?
you can remove the bulk hosts from the serverClass.conf file, so that inputs file wont be deployed to these bulk hosts. but still these hosts would be sending the logs as per their existing inputs file.

i am not sure of this idea - if we blacklist a host which was whitelisted earlier, then, will the host still be sending the logs or not? need to verify this.

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

pavi_pavi_p
Engager

Hello Sekar,

Thanks for your response.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk.

0 Karma

pavi_pavi_p
Engager

Help with the SPL Query to delete bulk host list!

0 Karma

pavi_pavi_p
Engager

I know how to delete single host from Splunk.

Ex : Host=hostname or ipaddress | delete.

looking SPL query for bulk host deletion.

0 Karma

inventsekar
Super Champion

Host=hostname or ipaddress | delete
this will delete the logs from the host.

earlier team forgot the credentials of deployment server and we are deploy new DS. Kindly assist with the delete bulk host from Splunk
To deploy a new deployment server, i am not sure why you want to bulk delete hosts.
kindly update us clearly about the situation.

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...