Archive
Highlighted

Is it safe to delete everything under $SPLUNK_HOME/var?

Splunk Employee
Splunk Employee

In a testing scenario, I want to clean an instance of splunk and remove all indexes, all logs, etc. I don't really care about changing the admin password or preserving any user information. Can I rm -rf $SPLUNK_HOME/var safely? Are there any surprises I should look out for if I do?

Tags (2)
0 Karma
Highlighted

Re: Is it safe to delete everything under $SPLUNK_HOME/var?

Splunk Employee
Splunk Employee

splunkweb's session files are stored in $SPLUNK_HOME/var/run/splunk, as are Splunk's PID files. The latter are what allow the CLI to know whether Splunk is running or not. If you delete those PID files while Splunk is running, the CLI will incorrectly report Splunk as stopped even though the processes are still alive.

0 Karma