Getting Data In

How can I disconnect a forwarder to avoid going over my license limits?

shakeel253
Explorer

I have a certain limit on my Splunk Account on how much Splunk I can use, I recently installed Splunk forwarder to some of the servers and now I am exceeding Splunk License usage.

My question is what changes should I make on the server so I can stop forwarding logs?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You probably have a * which is picking up all the logs. So rather than turning the forwarder off, how about limiting the amount of logs your ingesting?

How big is your license? How many forwarders do you have? How many unique log files are you ingesting? What kind of data is it (i.e. firewall, security event logs)?

You will have to make the changes under inputs.conf on the server with the UF to limit the amount of data flowing in

0 Karma

jawaharas
Motivator

Thanks. Can you specify the parameter name in the 'inputs.conf' that need to be modified to limit the amount of data flowing in?

0 Karma

inventsekar
Super Champion

You can stop the splunk process, which will stop forwarding the logs -

Unix

cd $SPLUNK_HOME/bin
./splunk stop

(/opt/splunkforwarder/bin/splunk -stop)

windows
cd %SPLUNK_HOME%\bin
.\splunk stop

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...