I don't want to use indexer acknowledgement in my cluster environment. I also, don't want the warnings that I'm not using it filling up my logs.
How can I disable the warning?
Sorry, there is no workaround at present.
We have a fix slated for 5.0.5 which will log messages to splunkd.log. It will log message for only first 10 forwarder instances not using ACK.
There is only one way of getting rid of that warning.
In the outputs.conf of your forwarders, include useACK=true
I'm afraid there is nothing else you could do
Sorry - that doesn't answer the question. It's like the old joke, Patient: "Doctor, it hurts when I do that." Doctor: "Don't do that."
I've submitted an RFE to be able to disable the warnings.
