I'm one overage away from violating my licenses due to an AV scan on my QA environments and would like to temporarily stop indexing during those AV scans.
How can I block Splunk from indexing during a specified time period?
You're correct on the part that it's not a natively available feature of Splunk, but there can be workarounds. I forgot to ask whether you want to disable indexing from all forwarders OR just few and you want it to be done by making Indexer not do indexing OR forwarders not to monitoring?? The solution may vary accordingly.
E.g., for disabled monitoring at forwarders, my suggestion would be to create a scripted input, which run on a cron schedule to run before and after your outage windows and disables all data inputs using CLI command. If you're following best practices for deploying data inputs using apps, you could just disable app itself and enable it back after outage windows. http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Managingappobjects#Disable_an_app_or_add-on_...
After thinking about this over the weekend, I think I'm going to use an external automation tool (Automic One Automation) to stop the Splunk service on those forwarders during those AV scans.. I appreciate your help with this issue and will accept your answer as it's the best answer for future Splunker's who don't have an Automation Engine available.
This is what I'm looking for but unfortunately my manager wants an outage window which we can index data. From my research, I don't think that's a Splunk feature. Can you confirm?
