Getting Data In
Highlighted

If we are no longer using Splunk, but another department wants to use it, should we delete the data and configs, or just reinstall?

New Member

We have had Splunk implemented at my company for quite a few years. A new VP has taken over and he no longer wants to use it, and another department now wants to utilize Splunk. The old data is worthless. Would it be easier to delete the data, inputs, and most of the config, or reinstall/redeploy? If the latter, do I even have to mess with deleting the data out of Splunk? Either way, a lot of work needs to be done and I'd rather work smarter not harder.

It should be noted that the Splunk version is at 6.0 and would need to be upgraded anyway.

Thanks!

0 Karma
Highlighted

Re: If we are no longer using Splunk, but another department wants to use it, should we delete the data and configs, or just reinstall?

Legend

I would just delete the indexes and all app folders

http://docs.splunk.com/Documentation/Splunk/6.1.1/Indexer/RemovedatafromSplunk

0 Karma
Highlighted

Re: If we are no longer using Splunk, but another department wants to use it, should we delete the data and configs, or just reinstall?

Builder

I would recommend a clean install with a newer version. 6.3 introduced some big performance improvements. Just be sure to get a copy of your license before deleting the existing install.

0 Karma
Highlighted

Re: If we are no longer using Splunk, but another department wants to use it, should we delete the data and configs, or just reinstall?

SplunkTrust
SplunkTrust

I'd probably re-install, assuming nothing will transfer to the new department (users, custom dashboards, etc.). Be sure to save your license file(s) from $SPLUNK_HOME/etc/licenses for the new installation.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: If we are no longer using Splunk, but another department wants to use it, should we delete the data and configs, or just reinstall?

New Member

Uninstall old Splunk before re-install?

0 Karma
Highlighted

Re: If we are no longer using Splunk, but another department wants to use it, should we delete the data and configs, or just reinstall?

SplunkTrust
SplunkTrust

Yes. Be sure to also delete $SPLUNKDB, if it's apart from $SPLUNKHOME.

---
If this reply helps you, an upvote would be appreciated.
0 Karma