Getting Data In

Disable index

sidekix24
Path Finder

We'd like to disable indexing to a certain index temporarily but we don't have access to the forwarder. Will simply disabling the index in the Splunk UI do the trick? It shouldn't delete our data or cause any other issues, correct?

Please let me know if anyone has any suggestions

Thanks

0 Karma

woodcock
Esteemed Legend

If you disable the index then 1 of 2 things will happen. Either the data will end up in your lastChanceIndex (most people do not define this) or it will temporarily back up on the forwarder and the forwarder will begin to consume a large amount of RAM and disk space and this will grow for the duration of the outage; this can cause significant problems on the forwarder for the REAL work that is supposed to happen there. When the index comes back online, all the backlogged data will come flooding in to the indexers which can overwhelm the indexers and also cause license violations (think 5 days of data coming to the indexers in just an hour) which will also cause a huge CPU spike on the forwarder. I would not go this route.

I would either:

Configure a lastChanceIndex and then kill the existing index.
https://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Indexesconf

Configure a nullRoute on the Indexer to divert this data from the current destination to a trash can:
http://docs.splunk.com/Documentation/Splunk/6.5.3/Forwarding/Routeandfilterdatad#Filter_event_data_a...

somesoni2
SplunkTrust
SplunkTrust

From Documentation link

Unlike the remove index command, disable index does not delete index data, and it is reversible (with the enable index command). However, once an index is disabled, splunkd will no longer accept data targeted at it.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/RemovedatafromSplunk#Disable_an_index_with...

How have you configured data monitoring on forwarders, using deployment server to push apps OR directly updating configs on them? The reason I asked is that best method would to get all those data input configs disabled so that forwarder won't monitor and send data for that index, save precious resources on forwarder/indexer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...