how to manage large quantity of forwarders?

[yhjhoo]

Let's say there is an splunk enterprise instance and 10 splunk forwarders. I would like to enable and disable some splunk forwarders in splunk enterprise instance.

Is this possible?

[yhjhoo]

Enable UF to start pulling log from remote server, disable UF to stop pulling log.

We are doing it in this way as splunk license charge base on log size.

[satishsdange]

You can push precise config to pull data from UF & change config whenever you want to stop it using DS.

But this is not a recommended approach as all data could be used for operational intelligence. If you filter data, you may not achieve desired results.

[satishsdange · Accepted solution]

You can certainly use Deployment Server(DS) to push policies on remote UFs. You can also restart splunkd using DS.

Could you please elaborate what do you mean by enable/disable UF?