topic What's a safe way to clear all ITSI notable events? in Splunk ITSI

What's a safe way to clear all ITSI notable events?

paulstout — Tue, 29 Sep 2020 12:44:57 GMT

I am testing throttling/suppression on ITSI and would like to clear out the notables generated so far. Is this as simple as clearing them from index=itsi_tracked_alerts, or are there other cleanup tasks I should complete as well? If there's a published method I'm happy to read up on it myself, and thank you!

Re: What's a safe way to clear all ITSI notable events?

dmahler99 — Tue, 29 Sep 2020 16:12:41 GMT

to completely refresh and clean notable events , you can do the following (try this in test first, not prod) :

How to wipe all events from indexes and kvstores and start over

$SPLUNK_HOME/bin/splunk stop
$SPLUNK_HOME/bin/splunk clean eventdata -index itsi_tracked_alerts;
$SPLUNK_HOME/bin/splunk clean eventdata -index itsi_grouped_alerts;
$SPLUNK_HOME/bin/splunk start

$SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_group
$SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_state
$SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_tag
$SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_comment
$SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_ticketing

Re: What's a safe way to clear all ITSI notable events?

esnyder_splunk — Thu, 10 May 2018 18:01:45 GMT

This is also documented in the ITSI user manual: http://docs.splunk.com/Documentation/ITSI/3.1.0/User/Managenotableeventindexes#Clear_all_notable_events