Archive

How to Turn off indexing on dedicated search head?

Explorer

Splunk Deployment Document Page 98 states:
6. Set up the authentication method you want to use on the search head, just as you would for any
other Splunk instance. Do not set up any indexing on your search head, since that will violate its
license.

Exactly how do you turn off indexing on the search head?

Tags (1)
0 Karma

Explorer

This did not work for me. Splunk started behaving badly when I tried.
I figured out if you enable forwarding before defining and inputs, especially on the local box, then the search head does not start indexing. One thing I did get from this, as a newbie, was to always restart Splunk afetr making changes!! Thanks.

0 Karma

Splunk Employee
Splunk Employee

Be very careful when considering enabling SplunkLightForwarder app on the search head, as it will disable scheduled searches, and other functionalities:

http://splunk-base.splunk.com/answers/89515/oh-crap-scheduled-searches-have-stopped-running-without-...

Splunk Employee
Splunk Employee

The best method to achieve this is to turn your search-head into a LightWeightforwarder (will forward any data, including summary indexes to the indexers)

they are 3 tricky steps :

  • 1 make sure that all the indexes existing on the search-head are defined on the indexers too (in particular the summary indexes)
  • 2 turn on the SplunklightForwarder app on the search-head (specify the splunktcp port of the indexer, or of the cluster if you have load balancing)
    BUT this will turn off the web interface (splunkweb)
    REMARK : using the regular forwarder will not prevent the search-head to parse the events
    locally before forwading them.

  • 3 turn on the web interface that was shut down
    edit $SPLUNK_HOME/etc/system/local/web.conf


    [settings]
    startwebserver = 1

    and restart to apply

Enjoy.

Splunk Employee
Splunk Employee

yes, probably.

0 Karma

Champion

@yannK, Does this still apply to 5.0.1

0 Karma