move to proper dir

salt/common/tools/sbin/so-influxdb-clear

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+# Copyright 2014,2015,2016,2017,2018,2019,2020,2021 Security Onion Solutions, LLC
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+echo "This script is used to reduce the size of InfluxDB by removing old data and retaining only the duration specified."
+echo "The duration will need to be specified as an integer followed by the duration unit, without a space."
+echo "For example, to purge all data, but retain the past 3 months, specify 3mo for the duration."
+echo "The duration units are as follows:"
+echo "  mo - month(s)"
+echo "  w  - week(s)"
+echo "  d  - day(s)"
+
+while true; do
+echo ""
+read -p 'Enter the duration of past data that you would like to retain: ' duration
+duration=$(echo $duration | tr '[:upper:]' '[:lower:]')
+
+originalIFS=$IFS
+
+case "${duration}" in
+
+  [0-9]+mo$)
+    break
+    ;;
+
+  [0-9]+w$)
+    break
+    ;;
+
+  [0-9]+d$)
+    break
+    ;;
+
+  *)
+    echo ""
+    echo "Invalid duration."
+    ;;
+
+esac
+done
+
+IFS=$originalIFS
+
+echo "Cleaning InfluxDb and saving only the past ${duration}"
+docker exec -t so-influxdb /bin/bash -c "influx -ssl -unsafeSsl -database telegraf -execute \"DELETE FROM /.*/ WHERE \"time\" >= '2020-01-01T00:00:00.0000000Z' AND \"time\" <= now() - ${duration}\""