topic How to turn off indexer-acknowledgement warning? in Getting Data In

How to turn off indexer-acknowledgement warning?

petercow — Wed, 19 Jun 2013 14:35:46 GMT

I don't want to use indexer acknowledgement in my cluster environment. I also, don't want the warnings that I'm not using it filling up my logs.

How can I disable the warning?

asimagu — Wed, 26 Jun 2013 23:30:09 GMT

There is only one way of getting rid of that warning.

In the outputs.conf of your forwarders, include useACK=true

I'm afraid there is nothing else you could do

petercow — Thu, 27 Jun 2013 11:57:45 GMT

Sorry - that doesn't answer the question. It's like the old joke, Patient: "Doctor, it hurts when I do that." Doctor: "Don't do that."

I've submitted an RFE to be able to disable the warnings.

jkerai — Tue, 30 Jul 2013 20:57:42 GMT

Sorry, there is no workaround at present.

We have a fix slated for 5.0.5 which will log messages to splunkd.log. It will log message for only first 10 forwarder instances not using ACK.