There are few ways to suppress data in Splunk, like | delete command from search menu or splunk clean eventdata from shell. I wondering to know if there is a simple way to generate an alert when someone suppress data from Splunk.
You could search remotesearches.log for "| delete".
To find CLI commands, you have to be indexing the .bashhistory file of every user who can run the splunk clean command. Then it's a simple matter to search command histories for the command.
A clarification: splunk clean eventdata does not suppress data, it erases it.
--- If this reply helps you, an upvote would be appreciated.