Splunk Search

clean eventdata with wildcard


I have about 100 indexes that all start with the same prefix EnLog_ and I want to clean the data in all of them. Is there a way at the command line to use a wildcard to clear them all at once (ex. clean eventdata EnLog_*)?

Tags (3)
0 Karma


You could do this in bash:

for index in `find  /opt/splunk/var/lib/splunk -type d  -name "EngLog_*"`
  /opt/splunk/bin/splunk clean eventdata -index $index -f

Just be careful and try the find command outside of the script first!

There are a few directories that are not actual indexes, within that base directory. While they don't start with EngLog_*, I figure that other people may look at this answer as a pattern...

0 Karma


Guess that will work. Was hoping there was a more simple way

0 Karma


Doesn't seem like it accepts wildcard (splunk clean eventdata -index ). One workaround could be to get the list of indexes in excel, generate clean eventdata command for all and then put all those command in shell/batch script.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...