Modify your AWS data inputs

Modify your AWS data inputs in Data Manager.

Edit your AWS data inputs

Edit your data inputs after onboarding data for AWS accounts. At any given time during the edit, you can only take one kind of action at a time.

1. From the Splunk Cloud menu bar, select Data Manager.
2. From the Data Management page, find the AWS data input you want to revise, and click the Edit action.

Edit your data inputs after single account onboarding

During an edit of a single account data input, you can only edit regions. The account itself cannot be changed or edited.

You can complete the following actions through Data Manager:

• Add one or more new regions, but keep the existing regions as-is.
• Remove one or more existing regions, but don't add new regions.
• Add one or more new custom tags, but keep the existing custom tags as-is.
• Remove one or more existing custom tags, but don't add new custom tags.

For example, you can only add or remove regions as separate actions. You cannot add and remove at the same time.

Edit your data inputs after multiple account onboarding

During an edit of a multiple account data input, you can edit accounts and regions.

You can complete the following actions through Data Manager

• Add one or more new accounts, but keep the regions as-is.
• Remove one or more existing accounts, but keep the regions as-is.
• Add one or more regions, but keep the data accounts as-is.
• Remove one or more existing regions, but keep the data accounts as-is.
• Add one or more new accounts and add one or more new regions, but don't remove existing accounts or regions.
• Remove one or more existing accounts and remove one or more existing regions, but don't add new accounts or regions.
• Add one or more new custom tags, but keep the existing custom tags as-is.
• Remove one or more existing custom tags, but don't add new custom tags.

For example, you can only add or remove regions as separate actions. You cannot add and remove at the same time. The example remains true for accounts as well. You can only add or remove accounts as separate actions. You cannot add and remove at the same time.

Delete your AWS data inputs

Before you can delete your data inputs for Data Manager, you have to delete the resources that you created in Amazon Web Services (AWS).

You can delete the AWS resources from the CLI or from the AWS Console using the steps in the Data Manager app. The steps are slightly different if you have specified only us-east-1 for your data ingestion.

Single account data input delete

The steps are described in detail within Data Manager. The details are not duplicated here.

Even though you may not have selected the us-east-1 region for data ingestion, the CloudFormation templates create a stack or StackSet in this region anyway. See the Summary of CloudFormation stack templates section of the Onboard AWS in Data Manager topic in this manual.

To delete your AWS stack for a single account data input, complete the following steps:

1. Delete stack SplunkDMDataIngest-<input ID> from your non-us-east-1 regions.
   Wait for each stack to delete completely before proceeding.
2. If you get an error, see Troubleshoot the AWS CloudFormation Template deployment.
3. Delete stack SplunkDMDataIngest-<input ID> from region us-east-1.
   Wait for the stack to delete completely before proceeding.
4. If you get an error, see Troubleshoot the AWS CloudFormation Template deployment.
5. (Optional) If you have the SplunkDM-dataingest-dft-<input ID> S3 in us-east1, delete it.
6. (Optional) If you completed the previous step and you have the SplunkDMS3Bucket-<input ID> in us-east-1, delete it.

Navigate to the Data Manager app, and perform the following steps:

1. Click Delete Data Input to delete the data input.
2. After you have clicked Delete in the Data Manager app, the data input status on the Data Management home page is "Marked for delete." This takes several minutes while it deletes the HEC tokens and the KV Store configuration.

Multiple account data input delete

The steps are described in detail within Data Manager. The details are not duplicated here.

Even though you may not have selected the us-east-1 region for data ingestion, the CloudFormation templates create a stack or stackset in this region anyway. See the Summary of CloudFormation stack templates section of the Onboard AWS in Data Manager topic in this manual.

To delete your AWS stack for a multiple account data input, complete the following steps:

1. From the region of your control account.
2. Delete the stacks from the StackSet, using the data account IDs.
   1. Specify your regions in the order listed in Data Manager. Make sure that you do not change the order. The us-east-1 region is always last.
3. Wait till all stack instances are deleted.
4. If you get an error, see Troubleshoot the AWS CloudFormation Template deployment.
5. (Optional) If you have the SplunkDM-dataingest-cft-<input ID> S3 in us-east1, delete it.
6. (Optional) If you completed the previous step and you have the SplunkDMS3Bucket-<input ID> in us-east-1, delete it.

Navigate to the Data Manager app, and perform the following steps:

1. Click Delete Data Input to delete the data input.
2. After you have clicked Delete in the Data Manager app, the data input status on the Data Management home page is "Marked for delete." This takes several minutes while it deletes the HEC tokens and the KV Store configuration.