Hello, is there a way to remove all events from phantom
You can use the container deletion script to remove events from phantom: https://my.phantom.us/kb/80/
Quickest way would likely be to run the command per label you have in Phantom.
Irrespective of the app, events in splunk are only deleted (in actual sense not deleted but hidden on search) by using the delete command. Usage can be referred from here - https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Delete
If actually want to delete the data from splunk, this would mean removing the physical files (index buckets) from the index storage.
