Splunk Search

What exactly does splunk.exe clean eventdata -f do?

cboillot
Contributor

I get the it cleans out the eventdata, my question is where? Is this limited to the server the command was ran from? What does the '-f' do? what other parameter are there? Is this something that should be done regularly, or not at all? The only reference I can find is under Administrative CLI commands.

Could someone point me in the right direction?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The command splunk.exe clean eventdatawill clean data for single index (if -index parameter is provided) or all indexes from the current Splunk instance, which is typically an indexer. When run it gives a confirmation prompt before actually deleting the data from index(s). The -f suppresses the confirmation prompt. See this for more details.

https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/RemovedatafromSplunk#How_to_use_the_clean...

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The command splunk.exe clean eventdatawill clean data for single index (if -index parameter is provided) or all indexes from the current Splunk instance, which is typically an indexer. When run it gives a confirmation prompt before actually deleting the data from index(s). The -f suppresses the confirmation prompt. See this for more details.

https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/RemovedatafromSplunk#How_to_use_the_clean...

cboillot
Contributor

What happens if this is ran from a search head?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

It'll try to delete locally indexed data for specified index (or all indexes depending on parameter used). Usually Search Heads don't have any data locally indexed (all data being forwarded to Indexers), nothing would be done.

0 Karma

cboillot
Contributor

Thank you!

0 Karma

niketn
Legend

@cboillot, I think you need to correct the question and its description for us to assist you with the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cboillot
Contributor

Thanks for the heads, up. Done. Seams it doesn't like less-than or greater-than signs in the title.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...