I have inherited Splunk and I've been in the process of cleaning up 2 of the heavy forwarder and 2 syslog uni forwarder. These Splunk Forwarders are onprem running on Ubuntu and ingesting from various logs within (internally) the organizations network and forwarding to the Splunk Cloud Stack Victoria.
What I want to do as a first task is to remove log ingestion from any devices that are no longer sending logs, cleaning any of the logs specific to those devices, and stopping and delete so that all are refreshed.
Where do I begin...
