Splunk Enterprise Security

Working with the Splunk Enterprise Security demo, is there a way to reset/delete all the demo data?

mpuckettsc
Explorer

I'm working with the Splunk Enterprise Security demo. Is there a way to reset it / delete all the data that it starts with? I have a log sample from our Palo Alto and I want to see how that would be handled, but with all the sample data in there, I'm having a hard time wading through it all.

0 Karma

milesbrennan
Path Finder
find /opt/splunk/etc/apps/ -name *demo*.csv -exec rm -f {} \;

Run the first part of this command (before "-exec") to test you only see the ESS lookup files, then run the whole command to remove all lookups.

This actually runs through all applications, as there are mulitple directories for ESS. So if you get too many incorrect hits, you will need to manually add DA*, SA* and SplunkEnterprise* to the /opt/splunk/etc/apps directory path.

0 Karma

mpuckettsc
Explorer

Thanks, but I'm actually using the Splunk Enterprise Security demo which is cloud based. As far as I know I don't have the ability to run shell commands?

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...