Stop data collection on Splunk App for Infrastructure

If you delete an entity in the Splunk App for Infrastructure but do not stop data collection, the entity will reappear as soon as collectd sends metrics information to the Splunk App for Infrastructure.

To stop data collection, complete one of these tasks:

• Run the easy removal script on a host.
• Manually stop and remove the data collection agents from a host.

If you are collecting data from at least 1,000 entities, you must stop sending data from an entity for approximately 10 minutes before you can delete the entity. For every 10,000 entities from which you are collecting data, wait approximately 10 additional minutes before deleting the entity after stopping data collection from it.

Run the easy removal script

The script removes the universal forwarder on your host. If other apps are still using the universal forwarder on the host, do not use the script to stop data collection.

Follow these steps to get the easy removal script according to the host's operating system and run the script on the host you want to stop monitoring.

To remove the data collection agents, you must log in to an account with permissions to use sudo for root access. Do not log in as the root user.

Before you run the script, first confirm the host meets the data collection script requirements:

• *nix data collection requirements in the Install and Upgrade Splunk App for Infrastructure manual.
• Windows data collection requirements in the Install and Upgrade Splunk App for Infrastructure manual.

1. In the Splunk App for Infrastructure user interface, click the Add Data tab.
2. From the panel on the left of the window, select the operating system of the host you want to stop monitoring.
3. Under 2: Copy and paste the following into the command line of your host, select the Remove tab.
4. Copy the script.
5. Secure shell (SSH) into the host.
6. Run the script.

Example Linux/Unix removal script

For Linux/Unix, the script installs the unix-agent, runs unintsall_agent.sh to remove the universal forwarder and collectd, and then removes the unix-agent.

wget --no-check-certificate <hostname>:/static/app/splunk_app_infrastructure/unix_agent/unix-agent.tgz && tar -xzf unix-agent.tgz && cd unix-agent && bash uninstall_agent.sh && cd .. && rm -rf unix-agent

Example Mac OS X removal script

For Mac OS X, the script installs the osx-agent, runs unintsall_agent.sh to remove the universal forwarder and collectd, and then removes the osx-agent.

curl -ksL -o osx-agent.tgz <hostname>:/static/app/splunk_app_infrastructure/osx_agent/osx-agent.tgz && tar -xzf osx-agent.tgz && cd osx-agent && bash uninstall_agent.sh && cd .. && rm -rf osx-agent

Example Windows removal script

For Windows, the script runs a wmic command to uninstall the universal forwarder.

wmic product where name="UniversalForwarder" call uninstall

Manually stop data collection on a *nix host

To stop collecting log data from a *nix host, see Uninstall the universal forwarder in the Splunk Universal Forwarder Forwarder Manual.

To stop collecting metrics data from a host in the Splunk App for Infrastructure, you must stop collectd, remove the collectd plug-ins, or remove collectd on your host.

What you need to stop or remove collectd

The easiest way to stop or remove collectd is with a package manager. The following steps use these package managers according to the host's operating system:

• OSX: Homebrew
• Centos, Redhat, Fedora: yum
• SUSE, openSUSE: Zypper

For more information about collectd, see About using collectd.

Stop collectd

Stop collectd so that the host will no longer send metrics data to the Splunk App for Infrastructure.

Stop collectd on a Linux host:

$ sudo service collectd stop
$ sudo systemctl stop collectd

Stop collectd on an OSX host:

$ sudo brew services stop collectd

Remove the write_splunk and collectd plug-ins

Remove the plug-ins if you want to stop sending metrics data to the Splunk App for Infrastructure but do not want to remove collectd from your host.

For information about collectd and collectd plug-in locations, see collectd package sources, install commands, and locations.

1. Go to the collectd plug-in directory.
2. Delete the unix-agent/write_splunk.so file.
3. Go to the collectd directory.
4. Open the collectd.conf file.
5. Delete the Plugin write_splunk plug-in.

Remove collectd

Remove collectd on a Ubuntu or Debian host:

$ sudo apt-get purge --auto-remove collectd

Remove collectd on a Centos, Redhat, or Fedora host:

$ sudo yum autoremove collectd

Remove collectd on a SUSE or openSUSE host:

$ sudo zypper remove --clean-deps collectd

Remove collectd on an OSX host:

$ brew remove collectd

Manually stop data collection on a Windows host

Stop or remove the universal forwarder that's sending log and metrics data to the Splunk App for Infrastructure. See Uninstall the universal forwarder in the Splunk Universal Forwarder Forwarder Manual.

Manually stop data collection from your AWS account

You can either deselect data sources that you no longer want to collect from AWS, or remove your AWS account from the Splunk App for Infrastructure to stop data collection.

1. From the Splunk App for Infrastructure, go to the Add Data tab.
2. Select AWS.
3. Complete one of these options:
   1. In Step 2, deselect the data sources that you no longer want to collect from your AWS account.
   2. At the top of the page, click Delete this account to remove your AWS account.