Working with the Splunk Enterprise Security demo, is there a way to reset/delete all the demo data?

[mpuckettsc]

I'm working with the Splunk Enterprise Security demo. Is there a way to reset it / delete all the data that it starts with? I have a log sample from our Palo Alto and I want to see how that would be handled, but with all the sample data in there, I'm having a hard time wading through it all.

[milesbrennan]

find /opt/splunk/etc/apps/ -name *demo*.csv -exec rm -f {} \;

Run the first part of this command (before "-exec") to test you only see the ESS lookup files, then run the whole command to remove all lookups.

This actually runs through all applications, as there are mulitple directories for ESS. So if you get too many incorrect hits, you will need to manually add DA*, SA* and SplunkEnterprise* to the /opt/splunk/etc/apps directory path.

[mpuckettsc]

Thanks, but I'm actually using the Splunk Enterprise Security demo which is cloud based. As far as I know I don't have the ability to run shell commands?