topic Re: ./splunk disable app SplunkUniversalForwarder --> How does this work? in Getting Data In

./splunk disable app SplunkUniversalForwarder --> How does this work?

sarnagar — Sun, 06 Sep 2015 15:34:33 GMT

Hi All,

I have Splunk universal forwarder installed on my hosts. I want to disable this host from sending any data to the indexer and I do not want it to respond to any of the scheduled searches or alerts. How do I get this done? Kindly help.

Also what does the below command do?
./splunk disable app SplunkUniversalForwarder

Re: ./splunk disable app SplunkUniversalForwarder --> How does this work?

grijhwani — Sun, 06 Sep 2015 18:04:41 GMT

That depends on what platform you are running on. (You don't specify.)

On a *ix (e.g. Linux) it is as simple as disabling the service and then stopping id.

sudo /etc/init.d/splunk stop
sudo ~splunk/bin/splunk disable boot-start

I imagine on Windows it is similar (stop the service, with the Windows interface, then get Splunk to do the boot-start disable).

Re: ./splunk disable app SplunkUniversalForwarder --> How does this work?

andrewpappas — Tue, 16 Feb 2016 16:49:25 GMT

Should be:
sudo ~splunk/bin/splunk disable boot-start

Re: ./splunk disable app SplunkUniversalForwarder --> How does this work?

grijhwani — Wed, 09 Mar 2016 13:34:56 GMT

Indeed it should - duly corrected.