https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372409#M3210 <P>ssievert - Loved your response, and your time is much appreciated. I will pass this along to my customer. Thank you!!</P> Tue, 03 Oct 2017 13:47:28 GMT rholm01 2017-10-03T13:47:28Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372405#M3206 <P>I have a customer who wants to have the splunk forwarder turned off during certain critical processing time. </P> Mon, 02 Oct 2017 22:35:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372405#M3206 rholm01 2017-10-02T22:35:53Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372406#M3207 <P>Do you want Splunk to stop forwarding during this time, or stop collecting logs during this time? If you stop Splunk, and then start it up at a later time, it will "catchup" on the data that was missing.</P> Tue, 03 Oct 2017 00:23:41 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372406#M3207 sduff_splunk 2017-10-03T00:23:41Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372407#M3208 <P>You have to write a cronjob to do this. <BR /> To turn off splunk at certain time, you have to write a small script which will include splunk stop and start commands <BR /> or two separate cronjobs. </P> <P><A href="https://tecadmin.net/crontab-in-linux-with-20-examples-of-cron-schedule/">https://tecadmin.net/crontab-in-linux-with-20-examples-of-cron-schedule/</A></P> <P>Schedule a cron to execute on every Sunday at 5 PM.<BR /> This type of cron are useful for doing weekly tasks, like log rotation etc.</P> <PRE><CODE>#to start splunk again at 5pm sunday 0 17 * * 7 /opt/splunk/bin/splunk stop #to start splunk again at 6pm 0 18 * * 7 /opt/splunk/bin/splunk start </CODE></PRE> Tue, 03 Oct 2017 00:52:17 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372407#M3208 inventsekar 2017-10-03T00:52:17Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372408#M3209 <P>Wait, what? They want to have log collection/forwarding turned off during critical processing times? Seems a bit counter-intuitive to me. I would want to know if that critical processing caused any error messages as quickly as possible. What is your customer's concern? Are they worried the forwarder (a universal forwarder, I assume?) will delay their critical processes by 'stealing' too much CPU/memory?<BR /> Are their servers running at a CPU utilization well beyond 75% or so during those times?<BR /> Did they experience impact caused by the forwarder?<BR /> Those are the kinds of questions I would ask, because - ideally - you do not want to stop the forwarder for extended periods of time, especially on a system that creates a lot of log files that potentially roll quickly during higher utilization periods.</P> <P>If they can't be convinced to not do that kind of thing, cron is your friend. </P> Tue, 03 Oct 2017 06:30:40 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372408#M3209 s2_splunk 2017-10-03T06:30:40Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372409#M3210 <P>ssievert - Loved your response, and your time is much appreciated. I will pass this along to my customer. Thank you!!</P> Tue, 03 Oct 2017 13:47:28 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-turn-off-splunkd-during-certain-hours/m-p/372409#M3210 rholm01 2017-10-03T13:47:28Z