Is it safe to delete everything under $SPLUNK_HOME/var?

[bboe_splunk]

In a testing scenario, I want to clean an instance of splunk and remove all indexes, all logs, etc. I don't really care about changing the admin password or preserving any user information. Can I rm -rf $SPLUNK_HOME/var safely? Are there any surprises I should look out for if I do?

[ewoo]

splunkweb's session files are stored in $SPLUNK_HOME/var/run/splunk, as are Splunk's PID files. The latter are what allow the CLI to know whether Splunk is running or not. If you delete those PID files while Splunk is running, the CLI will incorrectly report Splunk as stopped even though the processes are still alive.