Data Manager

User Manual

This documentation does not apply to the most recent version of Data Manager. For documentation on the most recent version, go to the latest release.

Delete your AWS data inputs for Data Manager

Before you can delete your data inputs for Data Manager, you have to delete the resources that you created in Amazon Web Services (AWS).

Delete an AWS data input

You can delete the AWS resources from the CLI or from the AWS Console using the steps in the Data Manager app. The steps are slightly different if you have specified only us-east-1 for your data ingestion.

Single account data input delete

The steps are described in detail within Data Manager. The details are not duplicated here.

Even though you may not have selected the us-east-1 region for data ingestion, the CloudFormation templates create a stack or stackset in this region anyway. See Deploy CloudFormation templates.

To delete your AWS stack for a single account data input, complete the following steps:

  1. Delete stack SplunkDMDataIngest-<input ID> from your non-us-east-1 regions.
    Wait for each stack to delete completely before proceeding.
  2. If you get an error, see Troubleshoot Configuration.
  3. Delete stack SplunkDMDataIngest-<input ID> from region us-east-1.
    Wait for the stack to delete completely before proceeding.
  4. If you get an error, see Troubleshoot Configuration.
  5. (Optional) If you have the SplunkDM-dataingest-dft-<input ID> S3 in us-east1, delete it.
  6. (Optional) If you completed the previous step and you have the SplunkDMS3Bucket-<input ID> in us-east-1, delete it.

Navigate to the Data Manager app, and perform the following steps:

  1. Click Delete Data Input to delete the data input.
  2. After you have clicked Delete in the Data Manager app, the data input status on the Data Management home page is "Marked for delete." This takes several minutes while it deletes the HEC tokens and the KV Store configuration.

Multiple account data input delete

The steps are described in detail within Data Manager. The details are not duplicated here.

Even though you may not have selected the us-east-1 region for data ingestion, the CloudFormation templates create a stack or stackset in this region anyway. See Deploy CloudFormation templates.

To delete your AWS stack for a multiple account data input, complete the following steps:

  1. From the region of your control account.
  2. Delete the stacks from the StackSet, using the data account IDs.
    1. Specify your regions in the order listed in Data Manager. Make sure that you do not change the order. The us-east-1 region is always last.
  3. Wait till all stack instances are deleted.
  4. If you get an error, see Troubleshoot Configuration.
  5. (Optional) If you have the SplunkDM-dataingest-cft-<input ID> S3 in us-east1, delete it.
  6. (Optional) If you completed the previous step and you have the SplunkDMS3Bucket-<input ID> in us-east-1, delete it.

Navigate to the Data Manager app, and perform the following steps:

  1. Click Delete Data Input to delete the data input.
  2. After you have clicked Delete in the Data Manager app, the data input status on the Data Management home page is "Marked for delete." This takes several minutes while it deletes the HEC tokens and the KV Store configuration.
Last modified on 30 November, 2021
Edit your AWS data inputs for Data Manager   Amazon CloudWatch Logs admin prerequisites for Data Manager

This documentation applies to the following versions of Data Manager: 1.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters