What would be the method to retain data for required time period without retaining old instance?

[jdavis]

We have data on a Splunk instance that needs to be retained for audit purposes. The new instance owner will not allow the old data to be ingested. What would be method to retain data for required time period without retaining old instance?

[richgalloway]

It depends on your needs.  If the data can be retained in Splunk format then a simple backup of your warm and cold buckets should suffice.  When they're needed later, just spin up an indexer, restore the needed buckets to the appropriate "thawed" folder, issue splunk rebuild commands, and restart the indexer.