How to remove a host from Splunk Cloud, but not its historical data?

[sbutkowskiR1]

Greetings all.

I'm relatively new to Splunk and did not see an answer for this particular issue in the KB. Any help is appreciated.

I have alerts turned on for missing forwarders and am being notified every 15 minutes that one is missing. After a small amount of investigation, I found that this Windows host has been permanently powered down. I would like to remove this host, not only from alerting, but from Splunk Cloud all together.

I DO need to keep its historical data as we are in the Financial Tech industry and our retention policies are auditable. Does anyone know how to remove said host, but keep a record that it was there before removing it?

Thank you very much. If there is any more information necessary, I would be happy to provide it.

[woodcock]

Yes.  It depends on what search is generating the alert.

[richgalloway · Accepted solution]

If we're talking about the Cloud Monitoring Console then refreshing the forwarder list has no effect on the historical data.

[sbutkowskiR1]

Thank you so much. Funny story. We had a call scheduled with our Splunk migration architect not long after I posted this and this was EXACTLY the fix we implemented. The only additional step was that I logged into the Heavy Forwarder's GUI and was able to delete the record for the host from Settings> Forwarder Management, then proceeded to rebuild the Forwarder List.  Worked like a charm! 🙂