Knowledge Management

How to erase or delete the parsed Splunk ES TI data?

owenpcyip
New Member

I set the Max_age for each threat intelligence list for the TI data retention but it is not work, so I would like to remove the out-date data manually.

Please kindly tell me the datastore location or path in CLI mode. In addition, I would like to know how can I make the max_age setting work?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...