topic Re: How to disable a index temporarily in Installation

How to disable an index temporarily?

vrmandadi — Thu, 11 Jun 2020 22:57:04 GMT

I have an index that I want to disable for some time as a large amount of data is coming from it and it caused a license warning.

Please advise.

Re: How to disable a index temporarily

hmarkus — Wed, 12 Jun 2019 16:17:31 GMT

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/RemovedatafromSplunk#Disable_an_index_without_removing_it

Re: How to disable a index temporarily

Vijeta — Wed, 12 Jun 2019 16:21:04 GMT

@vrmandadi In your indexes.conf under your index stanza , just add disabled = true.
Or via UI go to Indexes -> Action -> Disable

Re: How to disable a index temporarily

vrmandadi — Wed, 12 Jun 2019 21:49:58 GMT

Hello @hmarkus

Thank you for your mail .We have a indexer cluster so on which box do I need to disable it.If I want to disable via CLI .What is that I need to add to that index is it enabled = 1 for that index

Re: How to disable a index temporarily

vrmandadi — Wed, 12 Jun 2019 21:50:57 GMT

Thank You for you response .Does this setting helps to reduce the license usage?

Re: How to disable a index temporarily

Vijeta — Wed, 12 Jun 2019 21:53:05 GMT

If the data is not indexed it won’t be counted against license .

Re: How to disable a index temporarily

vrmandadi — Thu, 13 Jun 2019 01:08:43 GMT

Thank you.So disabling will not get indexed right?..Just to confirm

Re: How to disable a index temporarily

Vijeta — Thu, 13 Jun 2019 01:29:47 GMT

Yes it won’t get indexed.

Re: How to disable a index temporarily

Vijeta — Thu, 13 Jun 2019 01:38:37 GMT

Also if you have the index enabled again then any data queued up in forwarder will get indexed to it .

Re: How to disable a index temporarily

hmarkus — Thu, 13 Jun 2019 07:15:33 GMT

As @Vijeta mentioned, you can also disable it by adding the disabled = true to your indexes.conf.
In an index cluster I would add the line in the indexes.conf in your app on the Cluster Master, that is used to configure all indexes in your Cluster (in $SPLUNK_HOME/etc/master-apps/), and than push your new configuration bundle.
On a single instance you could use the CLI

Re: How to disable a index temporarily

vrmandadi — Thu, 13 Jun 2019 14:29:04 GMT

So the events dont drop , are they still queued ? .If I want to ignore them and only get those events from the time it is enabled ,how can I do that

Re: How to disable a index temporarily

vrmandadi — Thu, 13 Jun 2019 14:38:49 GMT

https://answers.splunk.com/answers/179987/if-i-disable-an-index-will-events-for-that-index-s.html

Re: How to disable a index temporarily

vrmandadi — Thu, 13 Jun 2019 14:39:28 GMT

@hmarkus .Thank you for your reply .Once I enable back do i get the old events that were already indexed and do I get the data during the index disabled time .

If I want to ignore the data which is queued ,how can I do that and I do get the data whihc was indexed before the index is disabled right?

Thanks in Advance