Delete your AWS data inputs for Data Manager

Before you can delete your data inputs for Data Manager, you have to delete the resources that you created in Amazon Web Services (AWS).

Delete an AWS data input

You can delete the AWS resources from the CLI or from the AWS Console using the steps in the Data Manager app.

Single account data input delete

The steps are described in detail within Data Manager. The details are not duplicated here.

The CloudFormation templates create a stack or StackSet in the IAM Roles Region (default IAM Roles Region is us-east-1) and all the data regions that you select during the configuration of the input. See the Summary of CloudFormation stack templates section of the Onboard AWS in Data Manager topic in this manual.

To delete your AWS stack for a single account data input, complete the following steps:

1. Delete stack SplunkDMDataIngest-<input ID> from all regions except the region which is configured as IAM Roles region.
   Wait for each stack to delete completely before proceeding.
2. If you get an error, see Troubleshoot the AWS CloudFormation Template deployment.
3. Delete stack SplunkDMDataIngest-<input ID> from the region that is configured as the IAM Roles region.
   Wait for the stack to delete completely before proceeding.
4. If you get an error, see Troubleshoot the AWS CloudFormation Template deployment.
5. (Optional) If you have the sdm-dataingest-cft-<input ID>-<iam region suffix> S3 bucket in the region that is configured as IAM Roles region, empty it.
   The <iam region suffix> is an abbreviation of the IAM Roles region. For example, euc1 is an abbreviation of eu-central-1 and aps3 is an abbreviation of ap-south-1.
   If the IAM Roles region is us-east-1, there is no <iam region suffix>.
6. (Optional) If you completed the previous step and you have the SplunkDMS3Bucket-<input ID> stack in the region that is configured as IAM Roles region, delete it.

Navigate to the Data Manager app, and perform the following steps:

1. Click Delete Data Input to delete the data input.
2. After you have clicked Delete in the Data Manager app, the data input status on the Data Management home page is "Marked for delete." This takes several minutes while it deletes the HEC tokens and the KV Store configuration.

Multiple account data input delete

The steps are described in detail within Data Manager. The details are not duplicated here.

The CloudFormation templates create a stack or stackset in the IAM Roles Region (default IAM Roles region is us-east-1) and all the data regions that you select during the configuration of the input. See the Summary of CloudFormation stack templates section of the Onboard AWS in Data Manager topic in this manual.

To delete your AWS stack for a multiple account data input, complete the following steps:

1. From the region of your control account.
2. Delete the stacks from the StackSet, using the data account IDs.
   1. Specify your regions in the order listed in Data Manager. Make sure that you do not change the order. The IAM Roles region is always last.
3. Wait till all stack instances are deleted.
4. If you get an error, see Troubleshoot the AWS CloudFormation Template deployment.
5. (Optional) If you have the sdm-dataingest-cft-<input ID>-<iam region suffix> S3 bucket in the region that is configured as the IAM Roles region, empty it.
   The <iam region suffix> is an abbreviation of the IAM Roles region. For example, euc1 is an abbreviation of eu-central-1 and aps3 is an abbreviation of ap-south-1.
   If the IAM Roles region is us-east-1, there is no <iam region suffix>.
6. (Optional) If you completed the previous step and you have the SplunkDMS3Bucket-<input ID> stack in the region that is configured as the IAM Roles region, delete it.

Navigate to the Data Manager app, and perform the following steps:

1. Click Delete Data Input to delete the data input.
2. After you have clicked Delete in the Data Manager app, the data input status on the Data Management home page is "Marked for delete." This takes several minutes while it deletes the HEC tokens and the KV Store configuration.