Clear Linux System Logs [splunk-edr]

`get_endpoint_data` `get_endpoint_data_edr` ((TERM(vi) 
OR TERM(vim) 
OR TERM(nano) 
OR (TERM(echo) 
AND TERM(>)) 
OR TERM(visudo) 
OR TERM(rm) 
OR (TERM(dd) 
AND TERM(if)) 
OR (TERM(cat) 
AND "/dev/null") 
OR (TERM(truncate) 
AND TERM(0)) 
OR (TERM(tee) 
AND NOT TERM(-a)) 
OR TERM(shred) 
OR TERM(wipe)) 
AND ("auth.log" 
OR TERM(faillog) 
OR TERM(secure) 
OR TERM(syslog) 
OR TERM(messages) 
OR TERM(utmp) 
OR TERM(wtmp) 
OR "kern.log" 
OR "audit.log" 
OR "cron.log" 
OR "error.log" 
OR "access.log" 
OR "boot.log" 
OR "mysqld.log" 
OR TERM(httpd) 
OR "yum.log")) 
OR TERM(covermyass)
| regex process!="(?i)(\/)?(etc
| home
| opt
| bin
| sbin
| dev
| ext
| lib
| media
| mnt
| proc
| root
| sys
| tmp
| usr
| boot)\/\w+"
| table _time, host, user, process, process_*
| bin span=1s
| stats values(*) as * by _time, host
| where match(process, "(?i)(vi
| vim
| nano
| echo.*\>
| visudo
| rm
| shred
| wipe)\s") 
OR match(process, "(?i)dd\s.*if[^a-z0-9]") 
OR match(process, "(?i)truncate\s") 
OR (match(process, "(?i)tee") and not match(process, "(?i)tee\s.*-a"))