https://community.splunk.com/t5/Getting-Data-In/how-to-start-over-from-scratch/m-p/311880#M93267 <P>The most complete start-from-scratch would be "remove splunk directory, unpack fresh splunk". Fast too, and possibly with a new version <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sun, 25 Feb 2018 22:04:32 GMT martin_mueller 2018-02-25T22:04:32Z https://community.splunk.com/t5/Getting-Data-In/how-to-start-over-from-scratch/m-p/311879#M93266 <P>Hi, </P> <P>I'm learning splunk enterpise (currently in free mode), and I wanted a clean start, so I did a splunk clean all.<BR /> No it shows I'm indexing 513GB (???) which is 1000 times(!!!) more that the the daily quota.<BR /> Also I thought it will remove custom indexes, but mine clearly shows up.<BR /> How can I REALLY go back to square one (index and application- every data since install)?</P> <P>Regards,<BR /> Ferenc Lazar</P> Sun, 25 Feb 2018 19:45:58 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-start-over-from-scratch/m-p/311879#M93266 ferenc0521 2018-02-25T19:45:58Z https://community.splunk.com/t5/Getting-Data-In/how-to-start-over-from-scratch/m-p/311880#M93267 <P>The most complete start-from-scratch would be "remove splunk directory, unpack fresh splunk". Fast too, and possibly with a new version <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sun, 25 Feb 2018 22:04:32 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-start-over-from-scratch/m-p/311880#M93267 martin_mueller 2018-02-25T22:04:32Z