Splunk Search

clean eventdata with wildcard

jedatt01
Builder

I have about 100 indexes that all start with the same prefix EnLog_ and I want to clean the data in all of them. Is there a way at the command line to use a wildcard to clear them all at once (ex. clean eventdata EnLog_*)?

Tags (3)
0 Karma

lguinn2
Legend

You could do this in bash:

for index in `find  /opt/splunk/var/lib/splunk -type d  -name "EngLog_*"`
do
  /opt/splunk/bin/splunk clean eventdata -index $index -f
done

Just be careful and try the find command outside of the script first!

There are a few directories that are not actual indexes, within that base directory. While they don't start with EngLog_*, I figure that other people may look at this answer as a pattern...

0 Karma

jedatt01
Builder

Guess that will work. Was hoping there was a more simple way

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Doesn't seem like it accepts wildcard (splunk clean eventdata -index ). One workaround could be to get the list of indexes in excel, generate clean eventdata command for all and then put all those command in shell/batch script.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...