https://community.splunk.com/t5/Splunk-SOAR/Remove-all-events-from-phantom/m-p/416747#M76 <P>Hello, is there a way to remove all events from phantom</P> Sun, 07 Jun 2020 17:45:34 GMT impsk 2020-06-07T17:45:34Z https://community.splunk.com/t5/Splunk-SOAR/Remove-all-events-from-phantom/m-p/416747#M76 <P>Hello, is there a way to remove all events from phantom</P> Sun, 07 Jun 2020 17:45:34 GMT https://community.splunk.com/t5/Splunk-SOAR/Remove-all-events-from-phantom/m-p/416747#M76 impsk 2020-06-07T17:45:34Z https://community.splunk.com/t5/Splunk-SOAR/Remove-all-events-from-phantom/m-p/416748#M77 <P>Irrespective of the app, events in splunk are only deleted (in actual sense not deleted but hidden on search) by using the delete command.<BR /> Usage can be referred from here - <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Delete">https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Delete</A></P> <P>If actually want to delete the data from splunk, this would mean removing the physical files (index buckets) from the index storage. </P> Mon, 10 Jun 2019 14:21:50 GMT https://community.splunk.com/t5/Splunk-SOAR/Remove-all-events-from-phantom/m-p/416748#M77 amitm05 2019-06-10T14:21:50Z https://community.splunk.com/t5/Splunk-SOAR/Remove-all-events-from-phantom/m-p/416749#M78 <P>You can use the container deletion script to remove events from phantom: <BR /> <A href="https://my.phantom.us/kb/80/">https://my.phantom.us/kb/80/</A></P> <P>Quickest way would likely be to run the command per label you have in Phantom.</P> Tue, 18 Jun 2019 15:41:39 GMT https://community.splunk.com/t5/Splunk-SOAR/Remove-all-events-from-phantom/m-p/416749#M78 WalshyB 2019-06-18T15:41:39Z