Splunk Enterprise

How to decommision Splunk?

New Member


We are planning to decommission splunk enterprise in our environment. We need to stop sending data to splunk . How should we proceed , from where we should start? Can we find any SOP for this decommision process. But we want to store the indexed data for more than 365 days . 

This is new task we are handling for the first time , any proper guidance will be much appreciated.


Thanks in advance.

Labels (1)
Tags (1)
0 Karma



Here is some guidelines what you can /should do, but probably this list not cover all steps what you need to do.

  1. Disable receiving on splunk indexer side
  2. Disable possible alerts etc. configure inside of splunk
  3. Extend index retention to 1y if it's not already done
  4. Remove all UF and other inputs which you are using to feed events to splunk
  5. After 1year you can stop splunk or other option is archive all data before that and set up another instance where to retrieve it as thawed if needed.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...