Getting Data In

If we are no longer using Splunk, but another department wants to use it, should we delete the data and configs, or just reinstall?

jjlambre
New Member

We have had Splunk implemented at my company for quite a few years. A new VP has taken over and he no longer wants to use it, and another department now wants to utilize Splunk. The old data is worthless. Would it be easier to delete the data, inputs, and most of the config, or reinstall/redeploy? If the latter, do I even have to mess with deleting the data out of Splunk? Either way, a lot of work needs to be done and I'd rather work smarter not harder.

It should be noted that the Splunk version is at 6.0 and would need to be upgraded anyway.

Thanks!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'd probably re-install, assuming nothing will transfer to the new department (users, custom dashboards, etc.). Be sure to save your license file(s) from $SPLUNK_HOME/etc/licenses for the new installation.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'd probably re-install, assuming nothing will transfer to the new department (users, custom dashboards, etc.). Be sure to save your license file(s) from $SPLUNK_HOME/etc/licenses for the new installation.

---
If this reply helps you, Karma would be appreciated.

jjlambre
New Member

Uninstall old Splunk before re-install?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes. Be sure to also delete $SPLUNK_DB, if it's apart from $SPLUNK_HOME.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jeremiahc4
Builder

I would recommend a clean install with a newer version. 6.3 introduced some big performance improvements. Just be sure to get a copy of your license before deleting the existing install.

0 Karma

sundareshr
Legend

I would just delete the indexes and all app folders

http://docs.splunk.com/Documentation/Splunk/6.1.1/Indexer/RemovedatafromSplunk

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...