Getting Data In

Can I disable Splunk from indexing data for a specific time frame?

skoelpin
SplunkTrust
SplunkTrust

I'm one overage away from violating my licenses due to an AV scan on my QA environments and would like to temporarily stop indexing during those AV scans.

How can I block Splunk from indexing during a specified time period?

0 Karma
1 Solution

somesoni2
Revered Legend

So you want to stop all indexing for that window OR only some specific data input?

View solution in original post

0 Karma

somesoni2
Revered Legend

So you want to stop all indexing for that window OR only some specific data input?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Yes, I want to disable ALL logging during a 1-2 hour window.

0 Karma

somesoni2
Revered Legend

You're correct on the part that it's not a natively available feature of Splunk, but there can be workarounds. I forgot to ask whether you want to disable indexing from all forwarders OR just few and you want it to be done by making Indexer not do indexing OR forwarders not to monitoring?? The solution may vary accordingly.
E.g., for disabled monitoring at forwarders, my suggestion would be to create a scripted input, which run on a cron schedule to run before and after your outage windows and disables all data inputs using CLI command. If you're following best practices for deploying data inputs using apps, you could just disable app itself and enable it back after outage windows. http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Managingappobjects#Disable_an_app_or_add-on_...

skoelpin
SplunkTrust
SplunkTrust

After thinking about this over the weekend, I think I'm going to use an external automation tool (Automic One Automation) to stop the Splunk service on those forwarders during those AV scans.. I appreciate your help with this issue and will accept your answer as it's the best answer for future Splunker's who don't have an Automation Engine available.

ppablo
Community Manager
Community Manager

Hi @skoelpin

Maybe some of the ideas in this previous post might help?
https://answers.splunk.com/answers/332983/how-to-index-certain-logs-only-during-a-certain-ti.html

skoelpin
SplunkTrust
SplunkTrust

This is what I'm looking for but unfortunately my manager wants an outage window which we can index data. From my research, I don't think that's a Splunk feature. Can you confirm?

0 Karma