Installation

Clean EventData

alessioquieti
Engager

Hy, i've a free Version for Linux, and i've a problem when i try to delete all eventData via CLI with: ./splunk clean eventdata It needs to stop splunk, but if i stop splunk, i'll lost all logs during the reboot. How can i resolve it, is there a solution???? Thanks

Tags (1)

Starlette
Contributor

Hai There,

To avoid dataloss during restarts of an indexer you have to take a look at putting a forwarder in front.

see http://www.splunk.com/base/Documentation/latest/Installation/CapacityplanningforalargerSplunkdeploym...

cheers Starlette

0 Karma

alessioquieti
Engager

Sorry, the forwarders solution is excellent, but not good yet when you have a lot of machines, in fact, each forwarder must be installed on every system which you would receive logs. Is it right?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...