Splunk SOAR (f.k.a. Phantom)

Remove all events from phantom

impsk
New Member

Hello, is there a way to remove all events from phantom

Labels (1)
0 Karma

WalshyB
SplunkTrust
SplunkTrust

You can use the container deletion script to remove events from phantom:
https://my.phantom.us/kb/80/

Quickest way would likely be to run the command per label you have in Phantom.

amitm05
Builder

Irrespective of the app, events in splunk are only deleted (in actual sense not deleted but hidden on search) by using the delete command.
Usage can be referred from here -
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Delete

If actually want to delete the data from splunk, this would mean removing the physical files (index buckets) from the index storage.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...