Complete Refresh of Splunk Instance -- is it possible without re-installation?

[can_new_89]

Hello,

(I am very new to Splunk!)

I have a standalone Splunk Enterprise instance running from a Linux VM that I am using to practice splunking. I would like to completely reset/empty the instance and start fresh without uninstalling/reinstalling Splunk in my VM. Is this possible?

Some background: I used the cleanevents command from the CLI in my VM but it didn't remove the indexes. When I go to the web UI, navigate from Settings to Indexes, my indexes are all still present in the list but cannot be deleted manually (I get an error that the token can't be found).  If I can just essentially empty the instance and start fresh, that would be ideal.

Thank you in advance

[gcusello · Accepted solution]

Hi @can_new_89,

if you want to delete indexes, you have to remove (with no running Splunk) the index folder and the indexes.conf that you have in one app, in this way the index folders aren't recreated.

The main problema to reset splunk is that configurations are distributed in many sites.

anyway, you could remove all the conf files in all local local folders and reinstall Splunk.

In this way you shouldn't have custom configurations.

In other words a new installation without all the customization that are usually recorded in the local folders.

ciao.

Giuseppe

[can_new_89]

molto bene, grazie!

[gcusello]

Hi @can_new_89 ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉