topic Re: How to turn off logging from a particular host when a server is decomissioned? in Getting Data In

How to turn off logging from a particular host when a server is decomissioned?

Kaushikkatta03 — Wed, 14 Sep 2016 13:33:53 GMT

As one of our servers is decommissioned, we need to turn off the logging from that particular host. Please kindly help us in doing this.

Re: How to turn off logging from a particular host when a server is decomissioned?

esix_splunk — Wed, 14 Sep 2016 13:55:40 GMT

Stop Splunk running on the server.

Re: How to turn off logging from a particular host when a server is decomissioned?

inventsekar — Tue, 29 Sep 2020 11:01:02 GMT

for temporary turn off the data logging from a particular host, we can turn off the splunk process -
$SPLUNK_HOME/splunk stop

as host is decommissioned, you can uninstall the universal forwarder

If you configured the universal forwarder to start on boot, remove it from your boot scripts before you uninstall.
cd $SPLUNK_HOME
./splunk disable boot-start
Stop the forwarder.
./splunk stop
Uninstall the universal forwarder with your package management utilities
RedHat Linux
rpm -e splunk_product_name

Debian Linux
dpkg -r splunkforwarder

https://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Uninstalltheuniversalforwarder

Re: How to turn off logging from a particular host when a server is decomissioned?

somesoni2 — Wed, 14 Sep 2016 14:39:53 GMT

One option would to be blacklist the host serverclass.conf on Deployment server so that it doesn't receive any data input configuration and doesn't monitor/logs any data. The decommissioning should take care of the un-install anyways.

Re: How to turn off logging from a particular host when a server is decomissioned?

Kaushikkatta03 — Wed, 14 Sep 2016 14:51:08 GMT

Thanks I did it . logging stopped