Deployment Architecture

Splunk 4.1.7: How to disable index database locally on Lightweight forwarders?

vchin111
New Member

We have installed splunk 4.1.7 on linux servers and configured/enabled light weight forwarder to index logs from application/web servers to central splunk index server. By default, splunk is creating 500MB of database when splunk is installed. Since we have enabled lightweight forwarder on spluk clients (application/web servers), it should not index data locally on any of these clients, so how do we disable/reduce the database sizes on splunk clients( where light weight forwarders are enabled)?

Tags (1)
0 Karma

Takajian
Builder

As you know, Splunk Lightweight forwarder does not have index data. You do not need to care about indexed data size.
Enabling Lightweight forwarder means disabling storing data on forwarder.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...