How to stop data ingestion to Splunk permanently?

[Khalid]

We have an Splunk architecture with about 7 indexers,  3 search heads, 2 Heavy forwarders and a deployment server. We want to stop further data ingestion permanently but keep the servers up for searching historical logs. 
Can you please advice two or more methods to do so.  Thanks in advance.

[PickleRick]

You can disable listening ports so that the indexers don't receive connections from forwarders (of course if you have any local inputs defined, they will be still running; you have to disable them manually). You could also enable authentication of forwarders so that they can't connect and send anything.

Remember however, that your servers will continue to ingest own longs and push them into the _internal index.

If you want to keep old data, you also have to make sure it doesn't get rolled to frozen when it expires so you have to increase retention period accordingly.

And I'm pretty sure that you won't be able to search your data when the license expires.

[gcusello]

Hi @Khalid,

if your Indexers receive logs only from Universal or Heavy Forwarders, it's sufficient to disable Receiving on all the indexers.

It's an activity done by GUI on each Indexer.

If indexers have also other inputs (e.g. syslogs or HEC, you have to manually disable them.

In this way Indexers continue to work only for searches.

If you want to disable also the other Splunk instances, you can disable receiving also on HFs and, using the Deployment Server, disable all Apps on Universal Forwarders.

Ciao.

Giuseppe