topic Re: How to stop indexing local machine? in Getting Data In

How to stop indexing local machine?

kfelts68 — Mon, 09 Sep 2019 19:59:40 GMT

New to Splunk, I set the local machine as source.

So how do I edit/remove sources, including local machine?

Thanks in advance.

Re: How to stop indexing local machine?

jacobpevans — Mon, 09 Sep 2019 20:27:40 GMT

I'm not sure what you are asking, but you can probably start here: https://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsConf

Re: How to stop indexing local machine?

kfelts68 — Mon, 09 Sep 2019 20:39:20 GMT

Thank You Jacob.

Splunk is indexing data from the local machine. How do I stop it?

This is a windows 10 machine.

Re: How to stop indexing local machine?

jacobpevans — Mon, 09 Sep 2019 21:32:42 GMT

Is the data internal (index=_*) or custom data inputs?

If this is a remote machine, you can simply turn off the SplunkForwarder service. If you need Splunk to continue running (if it's a part of SplunkD aka the full Splunk instance), add this line to $SPLUNK_HOME\etc\system\local\inputs.conf to disable all monitoring:

[default]
disabled = true

Re: How to stop indexing local machine?

woodcock — Mon, 09 Sep 2019 22:46:08 GMT

You can hardcode any values that you like in the inputs.conf file on the forwarder. To change the host value, just add this:

host = <value that you prefer>

Re: How to stop indexing local machine?

woodcock — Mon, 09 Sep 2019 22:46:41 GMT

It is very unclear what you really mean/need.

Re: How to stop indexing local machine?

kfelts68 — Tue, 10 Sep 2019 12:43:56 GMT

Thank you Jacob, but I am not sure where to find "data internal (index=_*) or custom data inputs?" information at.

Re: How to stop indexing local machine?

kfelts68 — Tue, 10 Sep 2019 12:45:20 GMT

Where is the forwarder found on the local machine?

Re: How to stop indexing local machine?

kfelts68 — Tue, 10 Sep 2019 12:48:09 GMT

Woodcock:

Splunk was installed on my laptop.
Settings - Add Data - Monitor - Local Windows host monitoring.

How do I disable local Windows host monitoring?

Re: How to stop indexing local machine?

kfelts68 — Tue, 10 Sep 2019 12:54:15 GMT

Maybe I am confused as to how Splunk works? Does slunk only access the local system logs when requested?

I thought this was a type of active monitoring, or maybe not?

Re: How to stop indexing local machine?

jacobpevans — Tue, 10 Sep 2019 14:31:39 GMT

I'm replying to your other comment since it has more information.

Re: How to stop indexing local machine?

jacobpevans — Tue, 10 Sep 2019 14:32:48 GMT

Settings > Data Inputs > [Data Input] > Disable button

You'll normally find it under Files & Directories after Data Inputs, but it depends on how you set it up

Re: How to stop indexing local machine?

jacobpevans — Tue, 10 Sep 2019 14:34:26 GMT

By default, Splunk only monitors itself. If you want that turned off, you can just stop the splunk instance by running:

$SPLUNK_HOME\bin\splunk stop

Are you on Linux or Windows?

Re: How to stop indexing local machine?

kfelts68 — Tue, 10 Sep 2019 16:32:07 GMT

Windows 10.

The indexing is what I do not understand. With Splunk open and no searches entered, the What to Search box continues to index events. Every few seconds the number of indexed events continues to go up.

So as long as Splunk is open it is collecting data from sources?