Cleaning up inputs

[709_miner]

I have inherited Splunk and I've been in the process of cleaning up 2 of the heavy forwarder and 2 syslog uni forwarder.  These Splunk Forwarders are onprem running on Ubuntu and ingesting from various logs within (internally) the organizations network and forwarding to the Splunk Cloud Stack Victoria.

What I want to do as a first task is to remove log ingestion from any devices that are no longer sending logs, cleaning any of the logs specific to those devices, and stopping and delete so that all are refreshed.

Where do I begin...

[PickleRick]

I'm not sure what you're asking us about. You need to build an inventory of your sources including ingestion methods. Both what you have and what is configured on your Splunk components. Then compare those two.