Clear Linux System Logs [splunk-unix]

`get_endpoint_data` `get_endpoint_data_unix` (type=proctitle 
OR type=execve 
OR sourcetype=bash_history) 
AND ((TERM(vi) 
OR TERM(vim) 
OR TERM(nano) 
OR (TERM(echo) 
AND TERM(>)) 
OR TERM(visudo) 
OR TERM(rm) 
OR (TERM(dd) 
AND TERM(if)) 
OR (TERM(cat) 
AND "/dev/null") 
OR (TERM(truncate) 
AND TERM(0)) 
OR (TERM(tee) 
AND NOT TERM(-a)) 
OR TERM(shred) 
OR TERM(wipe)) 
AND ("auth.log" 
OR TERM(faillog) 
OR TERM(secure) 
OR TERM(syslog) 
OR TERM(messages) 
OR TERM(utmp) 
OR TERM(wtmp) 
OR "kern.log" 
OR "audit.log" 
OR "cron.log" 
OR "error.log" 
OR "access.log" 
OR "boot.log" 
OR "mysqld.log" 
OR TERM(httpd) 
OR "yum.log")) 
OR TERM(covermyass)
| rex field=_raw "(?i)proctitle=(\")?(?<proc>.+")
| eval process=mvappend(process, proc)
| regex process!="(?i)(\/)?(etc
| home
| opt
| bin
| sbin
| dev
| ext
| lib
| media
| mnt
| proc
| root
| sys
| tmp
| usr
| boot)\/\w+"
| table _time, host, user, process, process_*
| bin span=1s
| stats values(*) as * by _time, host
| where match(process, "(?i)(vi
| vim
| nano
| echo.*\>
| visudo
| rm
| shred
| wipe)\s") 
OR match(process, "(?i)dd\s.*if[^a-z0-9]") 
OR match(process, "(?i)truncate\s") 
OR (match(process, "(?i)tee") and not match(process, "(?i)tee\s.*-a"))