https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292276#M162811 <P>What happens if this is ran from a search head?</P> Tue, 20 Feb 2018 19:18:04 GMT cboillot 2018-02-20T19:18:04Z https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292272#M162807 <P>I get the it cleans out the eventdata, my question is where? Is this limited to the server the command was ran from? What does the '-f' do? what other parameter are there? Is this something that should be done regularly, or not at all? The only reference <EM>I</EM> can find is under <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/CLIadmincommands">Administrative CLI commands</A>. </P> <P>Could someone point me in the right direction?</P> Tue, 20 Feb 2018 17:48:49 GMT https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292272#M162807 cboillot 2018-02-20T17:48:49Z https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292273#M162808 <P>@cboillot, I think you need to correct the question and its description for us to assist you with the same.</P> Tue, 20 Feb 2018 17:52:40 GMT https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292273#M162808 niketn 2018-02-20T17:52:40Z https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292274#M162809 <P>Thanks for the heads, up. Done. Seams it doesn't like less-than or greater-than signs in the title.</P> Tue, 20 Feb 2018 17:59:29 GMT https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292274#M162809 cboillot 2018-02-20T17:59:29Z https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292275#M162810 <P>The command <CODE>splunk.exe clean eventdata</CODE>will clean data for single index (if <CODE>-index</CODE> parameter is provided) or all indexes from the current Splunk instance, which is typically an indexer. When run it gives a confirmation prompt before actually deleting the data from index(s). The <CODE>-f</CODE> suppresses the confirmation prompt. See this for more details.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/RemovedatafromSplunk#How_to_use_the_clean_command">https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/RemovedatafromSplunk#How_to_use_the_clean_command</A></P> Tue, 20 Feb 2018 18:53:28 GMT https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292275#M162810 somesoni2 2018-02-20T18:53:28Z https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292276#M162811 <P>What happens if this is ran from a search head?</P> Tue, 20 Feb 2018 19:18:04 GMT https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292276#M162811 cboillot 2018-02-20T19:18:04Z https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292277#M162812 <P>It'll try to delete locally indexed data for specified index (or all indexes depending on parameter used). Usually Search Heads don't have any data locally indexed (all data being forwarded to Indexers), nothing would be done.</P> Tue, 20 Feb 2018 19:25:23 GMT https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292277#M162812 somesoni2 2018-02-20T19:25:23Z https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292278#M162813 <P>Thank you!</P> Tue, 20 Feb 2018 20:57:47 GMT https://community.splunk.com/t5/Splunk-Search/What-exactly-does-splunk-exe-clean-eventdata-f-do/m-p/292278#M162813 cboillot 2018-02-20T20:57:47Z