https://community.splunk.com/t5/Installation/Clean-EventData/m-p/90803#M9470 <P>Sorry, the forwarders solution is excellent, but not good yet when you have a lot of machines, in fact, each forwarder must be installed on every system which you would receive logs. Is it right?</P> Thu, 18 Nov 2010 17:32:45 GMT alessioquieti 2010-11-18T17:32:45Z https://community.splunk.com/t5/Installation/Clean-EventData/m-p/90801#M9468 <P>Hy, i've a free Version for Linux, and i've a problem when i try to delete all eventData via CLI with: ./splunk clean eventdata It needs to stop splunk, but if i stop splunk, i'll lost all logs during the reboot. How can i resolve it, is there a solution???? Thanks </P> Wed, 17 Nov 2010 19:31:25 GMT https://community.splunk.com/t5/Installation/Clean-EventData/m-p/90801#M9468 alessioquieti 2010-11-17T19:31:25Z https://community.splunk.com/t5/Installation/Clean-EventData/m-p/90802#M9469 <P>Hai There,</P> <P>To avoid dataloss during restarts of an indexer you have to take a look at putting a forwarder in front.</P> <P>see <A href="http://www.splunk.com/base/Documentation/latest/Installation/CapacityplanningforalargerSplunkdeployment" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Installation/CapacityplanningforalargerSplunkdeployment</A></P> <P>cheers Starlette</P> Wed, 17 Nov 2010 21:32:48 GMT https://community.splunk.com/t5/Installation/Clean-EventData/m-p/90802#M9469 Starlette 2010-11-17T21:32:48Z https://community.splunk.com/t5/Installation/Clean-EventData/m-p/90803#M9470 <P>Sorry, the forwarders solution is excellent, but not good yet when you have a lot of machines, in fact, each forwarder must be installed on every system which you would receive logs. Is it right?</P> Thu, 18 Nov 2010 17:32:45 GMT https://community.splunk.com/t5/Installation/Clean-EventData/m-p/90803#M9470 alessioquieti 2010-11-18T17:32:45Z