How to decommision Splunk?

[mukundakenche]

Hi 

We are planning to decommission splunk enterprise in our environment. We need to stop sending data to splunk . How should we proceed , from where we should start? Can we find any SOP for this decommision process. But we want to store the indexed data for more than 365 days . 

This is new task we are handling for the first time , any proper guidance will be much appreciated.

Thanks in advance.

[isoutamo]

Hi

Here is some guidelines what you can /should do, but probably this list not cover all steps what you need to do.

1. Disable receiving on splunk indexer side
2. Disable possible alerts etc. configure inside of splunk
3. Extend index retention to 1y if it's not already done
4. Remove all UF and other inputs which you are using to feed events to splunk
5. After 1year you can stop splunk or other option is archive all data before that and set up another instance where to retrieve it as thawed if needed.

r. Ismo