https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-forwarder-so-it-does-not-forward-any-data/m-p/239199#M46491 <P>Sometimes due to a space issue, we have to stop the forwarder from sending data to Splunk.<BR /> However, when we start the forwarder, it sends the data which was not indexed during the time it was stopped.</P> <P>Our requirement is, when we start the forwarder, it should not send the un-indexed data and just start sending fresh data to Splunk.</P> Wed, 20 Jan 2016 11:31:03 GMT ayushchoudhary 2016-01-20T11:31:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-forwarder-so-it-does-not-forward-any-data/m-p/239199#M46491 <P>Sometimes due to a space issue, we have to stop the forwarder from sending data to Splunk.<BR /> However, when we start the forwarder, it sends the data which was not indexed during the time it was stopped.</P> <P>Our requirement is, when we start the forwarder, it should not send the un-indexed data and just start sending fresh data to Splunk.</P> Wed, 20 Jan 2016 11:31:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-forwarder-so-it-does-not-forward-any-data/m-p/239199#M46491 ayushchoudhary 2016-01-20T11:31:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-forwarder-so-it-does-not-forward-any-data/m-p/239200#M46492 <P>Do you have indexer acknowledgment enabled in <CODE>outputs.conf</CODE>on the forwarder? It is disabled by default, but from your description of the behavior, it sounds as if it is enabled. See <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/Forwarding/Protectagainstlossofin-flightdata">Protect against loss of in-flight data</A> in the <EM>Forwarding Data</EM> manual.</P> Wed, 20 Jan 2016 19:15:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-forwarder-so-it-does-not-forward-any-data/m-p/239200#M46492 ChrisG 2016-01-20T19:15:45Z