Installation

Complete Refresh of Splunk Instance -- is it possible without re-installation?

can_new_89
Engager

Hello,

(I am very new to Splunk!)

I have a standalone Splunk Enterprise instance running from a Linux VM that I am using to practice splunking. I would like to completely reset/empty the instance and start fresh without uninstalling/reinstalling Splunk in my VM. Is this possible?

Some background: I used the cleanevents command from the CLI in my VM but it didn't remove the indexes. When I go to the web UI, navigate from Settings to Indexes, my indexes are all still present in the list but cannot be deleted manually (I get an error that the token can't be found).  If I can just essentially empty the instance and start fresh, that would be ideal.

Thank you in advance

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @can_new_89,

if you want to delete indexes, you have to remove (with no running Splunk) the index folder and the indexes.conf that you have in one app, in this way the index folders aren't recreated.

The main problema to reset splunk is that configurations are distributed in many sites.

anyway, you could remove all the conf files in all local local folders and reinstall Splunk.

In this way you shouldn't have custom configurations.

In other words a new installation without all the customization that are usually recorded in the local folders.

ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @can_new_89,

if you want to delete indexes, you have to remove (with no running Splunk) the index folder and the indexes.conf that you have in one app, in this way the index folders aren't recreated.

The main problema to reset splunk is that configurations are distributed in many sites.

anyway, you could remove all the conf files in all local local folders and reinstall Splunk.

In this way you shouldn't have custom configurations.

In other words a new installation without all the customization that are usually recorded in the local folders.

ciao.

Giuseppe

can_new_89
Engager

molto bene, grazie!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @can_new_89 ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...