topic How to stop data ingestion to Splunk permanently? in Getting Data In

How to stop data ingestion to Splunk permanently?

Khalid — Tue, 30 May 2023 19:19:39 GMT

We have an Splunk architecture with about 7 indexers, 3 search heads, 2 Heavy forwarders and a deployment server. We want to stop further data ingestion permanently but keep the servers up for searching historical logs.
Can you please advice two or more methods to do so. Thanks in advance.

Re: Stop Data ingestion to Splunk permenantly.

gcusello — Tue, 30 May 2023 14:22:44 GMT

Hi @Khalid,

if your Indexers receive logs only from Universal or Heavy Forwarders, it's sufficient to disable Receiving on all the indexers.

It's an activity done by GUI on each Indexer.

If indexers have also other inputs (e.g. syslogs or HEC, you have to manually disable them.

In this way Indexers continue to work only for searches.

If you want to disable also the other Splunk instances, you can disable receiving also on HFs and, using the Deployment Server, disable all Apps on Universal Forwarders.

Ciao.

Giuseppe

Re: Stop Data ingestion to Splunk permenantly.

PickleRick — Tue, 30 May 2023 16:51:46 GMT

You can disable listening ports so that the indexers don't receive connections from forwarders (of course if you have any local inputs defined, they will be still running; you have to disable them manually). You could also enable authentication of forwarders so that they can't connect and send anything.

Remember however, that your servers will continue to ingest own longs and push them into the _internal index.

If you want to keep old data, you also have to make sure it doesn't get rolled to frozen when it expires so you have to increase retention period accordingly.

And I'm pretty sure that you won't be able to search your data when the license expires.