From a5ee8fb59d8a37ba71e1a596d20e78b103c97dfe Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 5 May 2021 14:56:53 -0400
Subject: [PATCH] fix the issues with so-influxdb-clear

---
 salt/common/tools/sbin/so-influxdb-clear | 44 ++++++++++--------------
 1 file changed, 18 insertions(+), 26 deletions(-)

diff --git a/salt/common/tools/sbin/so-influxdb-clear b/salt/common/tools/sbin/so-influxdb-clear
index c6d5446e9..809b17381 100644
--- a/salt/common/tools/sbin/so-influxdb-clear
+++ b/salt/common/tools/sbin/so-influxdb-clear
@@ -15,8 +15,14 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+modurregex="^[0-9]+mo$"
+wdurregex="^[0-9]+w$"
+ddurregex="^[0-9]+d$"
+
+echo ""
 echo "This script is used to reduce the size of InfluxDB by removing old data and retaining only the duration specified."
 echo "The duration will need to be specified as an integer followed by the duration unit, without a space."
+echo ""
 echo "For example, to purge all data, but retain the past 3 months, specify 3mo for the duration."
 echo "The duration units are as follows:"
 echo "  mo - month(s)"
@@ -24,35 +30,21 @@ echo "  w  - week(s)"
 echo "  d  - day(s)"
 
 while true; do
-echo ""
-read -p 'Enter the duration of past data that you would like to retain: ' duration
-duration=$(echo $duration | tr '[:upper:]' '[:lower:]')
+  echo ""
+  read -p 'Enter the duration of past data that you would like to retain: ' duration
+  duration=$(echo $duration | tr '[:upper:]' '[:lower:]')
 
-originalIFS=$IFS
-
-case "${duration}" in
-
-  [0-9]+mo$)
+  if [[ "$duration" =~ $modurregex ]] || [[ "$duration" =~ $wdurregex ]] || [[ "$duration" =~ $ddurregex ]]; then
     break
-    ;;
+  fi
 
-  [0-9]+w$)
-    break
-    ;;
-
-  [0-9]+d$)
-    break
-    ;;
-
-  *)
-    echo ""
-    echo "Invalid duration."
-    ;;
-
-esac
+  echo ""
+  echo "Invalid duration."
 done
 
-IFS=$originalIFS
-
 echo "Cleaning InfluxDb and saving only the past ${duration}"
-docker exec -t so-influxdb /bin/bash -c "influx -ssl -unsafeSsl -database telegraf -execute \"DELETE FROM /.*/ WHERE \"time\" >= '2020-01-01T00:00:00.0000000Z' AND \"time\" <= now() - ${duration}\""
\ No newline at end of file
+if docker exec -t so-influxdb /bin/bash -c "influx -ssl -unsafeSsl -database telegraf -execute \"DELETE FROM /.*/ WHERE \"time\" >= '2020-01-01T00:00:00.0000000Z' AND \"time\" <= now() - $duration\""; then
+  echo "InfluxDb clean complete."
+else
+  echo "Something went wrong with cleaning InfluxDB. Please verify that the so-influxdb Docker container is running, and check the log at /opt/so/log/influxdb/influxdb.log for any details."
+fi