topic Re: How to Turn off indexing on dedicated search head? in Splunk Enterprise

How to Turn off indexing on dedicated search head?

JBarkerMox — Wed, 14 Sep 2011 19:48:04 GMT

Splunk Deployment Document Page 98 states:
6. Set up the authentication method you want to use on the search head, just as you would for any
other Splunk instance. Do not set up any indexing on your search head, since that will violate its
license.

Exactly how do you turn off indexing on the search head?

Re: How to Turn off indexing on dedicated search head?

yannK — Wed, 14 Sep 2011 21:18:14 GMT

The best method to achieve this is to turn your search-head into a LightWeightforwarder (will forward any data, including summary indexes to the indexers)

they are 3 tricky steps :

1 make sure that all the indexes existing on the search-head are defined on the indexers too (in particular the summary indexes)
2 turn on the SplunklightForwarder app on the search-head (specify the splunktcp port of the indexer, or of the cluster if you have load balancing)
BUT this will turn off the web interface (splunkweb)
REMARK : using the regular forwarder will not prevent the search-head to parse the events
locally before forwading them.
3 turn on the web interface that was shut down
edit $SPLUNK_HOME/etc/system/local/web.conf
```
[settings]

startwebserver = 1
```
and restart to apply

Enjoy.

Re: How to Turn off indexing on dedicated search head?

JBarkerMox — Fri, 16 Sep 2011 13:55:33 GMT

This did not work for me. Splunk started behaving badly when I tried.
I figured out if you enable forwarding before defining and inputs, especially on the local box, then the search head does not start indexing. One thing I did get from this, as a newbie, was to always restart Splunk afetr making changes!! Thanks.

Re: How to Turn off indexing on dedicated search head?

bmacias84 — Tue, 05 Feb 2013 18:58:15 GMT

@yannK, Does this still apply to 5.0.1

Re: How to Turn off indexing on dedicated search head?

yannK — Tue, 05 Feb 2013 19:25:15 GMT

yes, probably.

Re: How to Turn off indexing on dedicated search head?

splunkIT — Wed, 29 May 2013 17:10:05 GMT

Be very careful when considering enabling SplunkLightForwarder app on the search head, as it will disable scheduled searches, and other functionalities:

http://splunk-base.splunk.com/answers/89515/oh-crap-scheduled-searches-have-stopped-running-without-any-apparent-reason