clean eventdata with wildcard

[jedatt01]

I have about 100 indexes that all start with the same prefix EnLog_ and I want to clean the data in all of them. Is there a way at the command line to use a wildcard to clear them all at once (ex. clean eventdata EnLog_*)?

[lguinn2]

You could do this in bash:

for index in `find  /opt/splunk/var/lib/splunk -type d  -name "EngLog_*"`
do
  /opt/splunk/bin/splunk clean eventdata -index $index -f
done

Just be careful and try the find command outside of the script first!

There are a few directories that are not actual indexes, within that base directory. While they don't start with EngLog_*, I figure that other people may look at this answer as a pattern...

[jedatt01]

Guess that will work. Was hoping there was a more simple way

[somesoni2]

Doesn't seem like it accepts wildcard (splunk clean eventdata -index ). One workaround could be to get the list of indexes in excel, generate clean eventdata command for all and then put all those command in shell/batch script.