Getting Data In

How to turn off indexer-acknowledgement warning?

petercow
Path Finder

I don't want to use indexer acknowledgement in my cluster environment. I also, don't want the warnings that I'm not using it filling up my logs.

How can I disable the warning?

Tags (2)
0 Karma

jkerai
Splunk Employee
Splunk Employee

Sorry, there is no workaround at present.

We have a fix slated for 5.0.5 which will log messages to splunkd.log. It will log message for only first 10 forwarder instances not using ACK.

asimagu
Builder

There is only one way of getting rid of that warning.

In the outputs.conf of your forwarders, include useACK=true

I'm afraid there is nothing else you could do

0 Karma

petercow
Path Finder

Sorry - that doesn't answer the question. It's like the old joke, Patient: "Doctor, it hurts when I do that." Doctor: "Don't do that."

I've submitted an RFE to be able to disable the warnings.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...