Splunk Enterprise Security

Working with the Splunk Enterprise Security demo, is there a way to reset/delete all the demo data?

mpuckettsc
Explorer

I'm working with the Splunk Enterprise Security demo. Is there a way to reset it / delete all the data that it starts with? I have a log sample from our Palo Alto and I want to see how that would be handled, but with all the sample data in there, I'm having a hard time wading through it all.

0 Karma

milesbrennan
Path Finder
find /opt/splunk/etc/apps/ -name *demo*.csv -exec rm -f {} \;

Run the first part of this command (before "-exec") to test you only see the ESS lookup files, then run the whole command to remove all lookups.

This actually runs through all applications, as there are mulitple directories for ESS. So if you get too many incorrect hits, you will need to manually add DA*, SA* and SplunkEnterprise* to the /opt/splunk/etc/apps directory path.

0 Karma

mpuckettsc
Explorer

Thanks, but I'm actually using the Splunk Enterprise Security demo which is cloud based. As far as I know I don't have the ability to run shell commands?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...