Hi Here is some guidelines what you can /should do, but probably this list not cover all steps what you need to do. Disable receiving on splunk indexer side Disable possible alerts etc. configure inside of splunk Extend index retention to 1y if it's not already done Remove all UF and other inputs which you are using to feed events to splunk After 1year you can stop splunk or other option is archive all data before that and set up another instance where to retrieve it as thawed if needed. r. Ismo ... View more