Deployment Architecture

disable sinkhole

dhs_harry08
Path Finder

I have a default inputs.conf configuration in splunk server as below.
[batch:///source=/opt/splunk/var/spool/splunk/]
move_policy = sinkhole

Can I disable it will it have any adverse affect to my splunk server. The thing is there are some sample logs coming into this directory and we are unable find the script or the guy who is doing it.
Also can I put disable=true in this stanza will it work or should I comment the entire thing.

Regards,
Harish

Tags (1)
0 Karma
1 Solution

dhs_harry08
Path Finder

I found the solution at last. These events were generated by an app by splunk SA-Eventgen. We were using PCI compliance app and while installation it seems this app was configured by default. After disabling the app these sample logs disappeared.

I found the solution in the Splunk security app FAQs.
http://docs.splunk.com/Documentation/ES/2.4/User/FAQ#How_do_I_manually_enable_eventgen.3F

But the same is not included in PCI compliance app documentation. Hope splunk sees this and update the PCI compliance app documentation.

Regards,
Harish

View solution in original post

0 Karma

dhs_harry08
Path Finder

I found the solution at last. These events were generated by an app by splunk SA-Eventgen. We were using PCI compliance app and while installation it seems this app was configured by default. After disabling the app these sample logs disappeared.

I found the solution in the Splunk security app FAQs.
http://docs.splunk.com/Documentation/ES/2.4/User/FAQ#How_do_I_manually_enable_eventgen.3F

But the same is not included in PCI compliance app documentation. Hope splunk sees this and update the PCI compliance app documentation.

Regards,
Harish

0 Karma

kristian_kolb
Ultra Champion

I don't think that you should disable the input. I believe that it's used by Splunk itself for some operations.

Setting move_policy to something other than sinkhole is not supported, according to the docs on inputs.conf;

http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Inputsconf

If you know the name of the file that gets created, you could probably look through /opt/splunk/ to see if you can find a script or saved summary search that creates such files.

Or in some app:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Eventgenconf

Or scheduled from an external script;
http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/MonitorfilesanddirectoriesusingtheCLI#Example...

Maybe it can also come from an external machine through a REST api call. That is just my guessing. Then there could perhaps be something to be found in the splunk web service log in the _internal index.

Hope this helps a little bit,

K

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...