Getting Data In

Scripting user deletes - will the clean userdata -f command delete admin account?


Per documention, I can delete all userdata using ./splunk clean userdata -f

Question: will this affect the admin account?

0 Karma


It will reset the admin password back to "changeme", and I think all other admin user object fields (ie, full name, timezone, etc) back to defaults. But it will NOT delete anything in etc/user/admin. BTW, it will not delete the etc/user/... dir for a user who has created any private objects (saved searches, etc) and those private objects will still exist in that path.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!