Getting Data In

Delete/clean all the contents of splunk

harshavrath
Contributor

Hi.

How to delete/clear all the indexed events,saved searches.How to make it brand new as it was after installing for the first time.

Any Suggestions are Appreciated,

Cheers.

0 Karma
1 Solution

chimbudp
Contributor

1) The below command will not delete the indexed data from the Splunk , instead it doesn't show the results in splunk search.
index=* | delete

2) Below is the purge script - copt it to your splunk server and save as (script.sh). Specify your app names if you would like to delete your local configurations.

Execute with command : sh purge.sh

This will cleanup all the indexed data and your app local configurations

#!/bin/bash
clear
/opt/splunk/bin/splunk stop
/opt/splunk/bin/splunk clean eventdata
rm -rf /opt/splunk/etc/apps/Your_app_name1/local/*
rm -rf /opt/splunk/etc/apps/your_app_name2/local/*
/opt/splunk/bin/splunk start

View solution in original post

chimbudp
Contributor

1) The below command will not delete the indexed data from the Splunk , instead it doesn't show the results in splunk search.
index=* | delete

2) Below is the purge script - copt it to your splunk server and save as (script.sh). Specify your app names if you would like to delete your local configurations.

Execute with command : sh purge.sh

This will cleanup all the indexed data and your app local configurations

#!/bin/bash
clear
/opt/splunk/bin/splunk stop
/opt/splunk/bin/splunk clean eventdata
rm -rf /opt/splunk/etc/apps/Your_app_name1/local/*
rm -rf /opt/splunk/etc/apps/your_app_name2/local/*
/opt/splunk/bin/splunk start

harshavrath
Contributor

Thank you.I just stopped splunk & deleted the folder.

0 Karma

linu1988
Champion

stop splunk

cd splunk\bin\
splunk clean eventdata -index <index_name>

easiest way, stop splunk. Delete the index store folders. restart splunk

0 Karma

harshavrath
Contributor

Hi i have installed Splunk on windows, how to delete the indexed data.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...