clean event data

[diegosainz]

Is there a way to disable this? We would like to ensure data integrity since other admins have root access on our splunk servers.

[pwattssplunk]

I am not aware of a method by which you can limit a subcommand of the $SPLUNK_HOME/bin/splunk command from the root user, but keep in mind beyond that, that ever index is essentially written to database files in the $SPLUNK_HOME filesystem. Because of that the root user will always be able to delete those files. Such is the price of providing root access to users in a Unix/Linux environment.