Roll back a CrowdStrike migration

Restore a batch of CrowdStrike inputs to the Splunk Add-on for CrowdStrike FDR so that you can resume ingestion there while you investigate migration issues.

Migration and rollback are available in Data Inputs version 1.18.1.

Roll back a migration when post-migration validation finds missing events, unexpected filtering or enrichment, or a deployment problem. A rollback applies to the entire migration run, including every input in the selected batch. It does not change data that has already been indexed.

The migration assistant shows the latest run. Keep the migration record and the source add-on configuration so that you can roll back later. There is no fixed rollback expiration period.

Note: To roll back only some inputs, migrate them in separate batches. Inputs outside the selected run are not affected.
  1. Log in to Splunk Cloud and select the Data Inputs app.
  2. On the Data Inputs page, select + Data Input.
  3. Make sure Ingest is selected, then select CrowdStrike and then select Next.
  4. On the CrowdStrike Data Onboarding page, select the option to migrate an existing CrowdStrike input and then select Next.
  5. Review the prerequisites page and select Next.
  6. On the CrowdStrike Migration Assistant page, review the latest run before starting rollback. Do not run a new assessment first, because it replaces the run displayed in the assistant.
  7. Select Roll back migration.
    Rollback applies to the whole run, not to individual inputs.
  8. Wait for the rollback to finish, and review its status.
    A successful rollback removes the inputs and connectors created in Data Inputs and restores the previous add-on configuration and enabled-input states.
  9. Go to the Splunk Add-on for CrowdStrike FDR to verify that the restored inputs are active when you want ingestion to resume through the add-on. If they remain inactive, review the rollback status and resolve any restoration errors before resuming ingestion. Do not manually activate them while rollback is incomplete.
  10. If you want to migrate the inputs again, run a fresh assessment after the rollback succeeds. See Migrate CrowdStrike inputs from the Splunk Add-on for CrowdStrike FDR.

The selected batch is configured to use the Splunk Add-on for CrowdStrike FDR again. Previously indexed data remains unchanged.

Note: If the rollback is incomplete, resolve the incomplete rollback before starting another migration. The add-on remains inactive when Data Inputs cannot confirm destination cleanup, to prevent both configurations from ingesting at the same time.