splunk clean

[amurleopard]

    The clean command deletes event data, global data, and user account data
    from your Splunk installation.

    Permanently remove event data from an index by typing, "./splunk clean
    eventdata". Set the index parameter to delete event data from a specific
    index. If you don't set an index, Splunk deletes all event data from all
    indexes.

    Remove global data (tags and source type aliases for events you indexed)
    from Splunk by typing, "./splunk clean globaldata".

    Remove user data (user accounts you've created) from Splunk by typing,
    "./splunk clean userdata".

    ** Caution: **
    Removing data is irreversible. Use caution when choosing what data to
    remove from your Splunk installation. If you want to get your data back,
    you must re-index the applicable data sources.

    ** Note: **
    Add the -f parameter to force clean to skip its confirmation prompts.


     Syntax:

        clean  eventdata [-f] [-index <name>]

        clean  (globaldata|userdata|locks|all|deployment-artifacts) [-f]

        clean  inputdata [<scheme>]

        clean  kvstore [-f] (-local|-all|-app <appname>|-app <appname> 
-collection <collection name>|-cluster)

        clean  raft [-f]

     Objects:

          eventdata    exported events indexed as raw log files

          globaldata   host tags, source type aliases

          userdata     user accounts

          inputdata    modular inputs checkpoint data

          locks        internal lockfiles (only on advice of Splunk Support)

          kvstore      application key/value-store database

          raft         search head cluster raft configuration

          all          everything above; *not* deployment-artifacts

          deployment-artifacts        files created by instance having acted as
                                      Deployment Server or Deployment Client
                                      (only on advice of Splunk Support)
     Required Parameters:

         eventdata     if no index specified, the default is to clean all
                       indexes

         inputdata     if no modular input scheme specified, the default is
                       to clean data for all registered modular inputs

         kvstore       no default mode is assumed, a valid mode must be given

     Optional Parameters:

         eventdata     index   name of index whose eventdata should be cleaned
                       f       forces clean to skip its confirmation prompt
                               (Cleaning cannot be undone. Use carefully!)

         globaldata    f       forces clean to skip its confirmation prompt
                               (Cleaning cannot be undone. Use carefully!)

         userdata      f       forces clean to skip its confirmation prompt
                               (Cleaning cannot be undone. Use carefully!)

         kvstore       local        drop local key value store database
                       all          delete data from all app collections
                       app          delete data from specific app collections
                       collection   delete data from specific collection
                                    (can be used only with app parameter)
                       cluster      drop current kvstore cluster configuration
                                    (use when you want to move current instance
                                    out of SHC/SHP and keep data)
                       f            forces clean to skip its confirmation prompt
                                    (Cleaning cannot be undone. Use carefully!)

         raft          f       forces clean to skip its confirmation prompt
                               (Cleaning cannot be undone. Use carefully!)

     Examples:

          ./splunk clean eventdata

          ./splunk clean globaldata

          ./splunk clean eventdata -index main -f

          ./splunk clean inputdata s3


     Type "help [object|topic]" to view help on a specific object or topic.

     Complete documentation is available online at: 
http://docs.splunk.com/Documentation