If we are no longer using Splunk, but another department wants to use it, should we delete the data and configs, or just reinstall?

[jjlambre]

We have had Splunk implemented at my company for quite a few years. A new VP has taken over and he no longer wants to use it, and another department now wants to utilize Splunk. The old data is worthless. Would it be easier to delete the data, inputs, and most of the config, or reinstall/redeploy? If the latter, do I even have to mess with deleting the data out of Splunk? Either way, a lot of work needs to be done and I'd rather work smarter not harder.

It should be noted that the Splunk version is at 6.0 and would need to be upgraded anyway.

Thanks!

[richgalloway · Accepted solution]

I'd probably re-install, assuming nothing will transfer to the new department (users, custom dashboards, etc.). Be sure to save your license file(s) from $SPLUNK_HOME/etc/licenses for the new installation.

[jjlambre]

Uninstall old Splunk before re-install?

[richgalloway]

Yes. Be sure to also delete $SPLUNK_DB, if it's apart from $SPLUNK_HOME.

[jeremiahc4]

I would recommend a clean install with a newer version. 6.3 introduced some big performance improvements. Just be sure to get a copy of your license before deleting the existing install.

[sundareshr]

I would just delete the indexes and all app folders

http://docs.splunk.com/Documentation/Splunk/6.1.1/Indexer/RemovedatafromSplunk