To remove all of the data from a specific Splunk index without using the slow "| delete" command:
- Stop Splunk
/path/to/splunk stop - Delete all the data from a specific index (for example "
main"):/path/to/splunk clean eventdata -index main
To remove all of the data from a specific Splunk index without using the slow "| delete" command:
/path/to/splunk stopmain"):/path/to/splunk clean eventdata -index main