I want to delete the data once taken by splunk cloud

[nishida_tada_ca]

What kind of procedure and authority are necessary when I want to delete the data once taken by splunk cloud? Sorry for the vague question.

[DavidHourani]

Hi @nishida_tada_caica,

You want to move your data on-prem then delete it from Splunk cloud ?

If so, then you have a couple of solutions :

1- Either do a simple deleteby adding can_delete role to your splunk user --- that doesn't guarantee that data is off the disks though, they will only be masked and non-searchable.

2- Contact support and ask them to clean the index -- this will completely remove data from the disks :
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/RemovedatafromSplunk#How_to_use_the_clean...

Let me know if that helps.

Cheers,
David