What kind of procedure and authority are necessary when I want to delete the data once taken by splunk cloud? Sorry for the vague question.
You want to move your data on-prem then delete it from Splunk cloud ?
If so, then you have a couple of solutions :
1- Either do a simple deleteby adding can_delete role to your splunk user --- that doesn't guarantee that data is off the disks though, they will only be masked and non-searchable.
2- Contact support and ask them to clean the index -- this will completely remove data from the disks :
Let me know if that helps.