Hi,
I'm learning splunk enterpise (currently in free mode), and I wanted a clean start, so I did a splunk clean all.
No it shows I'm indexing 513GB (???) which is 1000 times(!!!) more that the the daily quota.
Also I thought it will remove custom indexes, but mine clearly shows up.
How can I REALLY go back to square one (index and application- every data since install)?
Regards,
Ferenc Lazar
The most complete start-from-scratch would be "remove splunk directory, unpack fresh splunk". Fast too, and possibly with a new version 🙂
The most complete start-from-scratch would be "remove splunk directory, unpack fresh splunk". Fast too, and possibly with a new version 🙂