Splunk Enterprise

How to decommision Splunk?

New Member


We are planning to decommission splunk enterprise in our environment. We need to stop sending data to splunk . How should we proceed , from where we should start? Can we find any SOP for this decommision process. But we want to store the indexed data for more than 365 days . 

This is new task we are handling for the first time , any proper guidance will be much appreciated.


Thanks in advance.

Labels (1)
Tags (1)
0 Karma



Here is some guidelines what you can /should do, but probably this list not cover all steps what you need to do.

  1. Disable receiving on splunk indexer side
  2. Disable possible alerts etc. configure inside of splunk
  3. Extend index retention to 1y if it's not already done
  4. Remove all UF and other inputs which you are using to feed events to splunk
  5. After 1year you can stop splunk or other option is archive all data before that and set up another instance where to retrieve it as thawed if needed.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...