topic Re: clean eventdata with wildcard in Splunk Search

clean eventdata with wildcard

jedatt01 — Wed, 25 Jun 2014 13:15:11 GMT

I have about 100 indexes that all start with the same prefix EnLog_ and I want to clean the data in all of them. Is there a way at the command line to use a wildcard to clear them all at once (ex. clean eventdata EnLog_*)?

Re: clean eventdata with wildcard

somesoni2 — Wed, 25 Jun 2014 13:25:28 GMT

Doesn't seem like it accepts wildcard (splunk clean eventdata -index ). One workaround could be to get the list of indexes in excel, generate clean eventdata command for all and then put all those command in shell/batch script.

Re: clean eventdata with wildcard

jedatt01 — Wed, 25 Jun 2014 17:28:23 GMT

Guess that will work. Was hoping there was a more simple way

Re: clean eventdata with wildcard

lguinn2 — Thu, 26 Jun 2014 01:01:46 GMT

You could do this in bash:

for index in `find  /opt/splunk/var/lib/splunk -type d  -name "EngLog_*"`
do
  /opt/splunk/bin/splunk clean eventdata -index $index -f
done

Just be careful and try the find command outside of the script first!

There are a few directories that are not actual indexes, within that base directory. While they don't start with EngLog_*, I figure that other people may look at this answer as a pattern...