Getting Data In

How to turn off logging from a particular host when a server is decomissioned?

Kaushikkatta03
Explorer

As one of our servers is decommissioned, we need to turn off the logging from that particular host. Please kindly help us in doing this.

Tags (2)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

for temporary turn off the data logging from a particular host, we can turn off the splunk process -
$SPLUNK_HOME/splunk stop

as host is decommissioned, you can uninstall the universal forwarder

  1. If you configured the universal forwarder to start on boot, remove it from your boot scripts before you uninstall.
    cd $SPLUNK_HOME
    ./splunk disable boot-start

  2. Stop the forwarder.
    ./splunk stop

  3. Uninstall the universal forwarder with your package management utilities
    RedHat Linux
    rpm -e splunk_product_name

Debian Linux
dpkg -r splunkforwarder

https://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Uninstalltheuniversalforwarder

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

somesoni2
Revered Legend

One option would to be blacklist the host serverclass.conf on Deployment server so that it doesn't receive any data input configuration and doesn't monitor/logs any data. The decommissioning should take care of the un-install anyways.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

for temporary turn off the data logging from a particular host, we can turn off the splunk process -
$SPLUNK_HOME/splunk stop

as host is decommissioned, you can uninstall the universal forwarder

  1. If you configured the universal forwarder to start on boot, remove it from your boot scripts before you uninstall.
    cd $SPLUNK_HOME
    ./splunk disable boot-start

  2. Stop the forwarder.
    ./splunk stop

  3. Uninstall the universal forwarder with your package management utilities
    RedHat Linux
    rpm -e splunk_product_name

Debian Linux
dpkg -r splunkforwarder

https://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Uninstalltheuniversalforwarder

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

Kaushikkatta03
Explorer

Thanks I did it . logging stopped

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Stop Splunk running on the server.

0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...