Getting Data In

I set my receiver to also forward data to itself by mistake. How do I remove the forwarder instance without uninstalling the receiver?

superiorlabels
Explorer

I'm running 6.3.2 and when I did the initial setup for my receiver, I misunderstood the directions I was getting and mistakenly set the Receiver to also be a forwarder and a Receiver of itself. So I now have another Forwarder listed on my Deployment page and I would like to remove it without uninstalling and reinstalling the Receiver. It doesn't appear to be harming anything, just more of an eyesore to look at my deployment and have one server always listed as missing.

0 Karma

yannK
Splunk Employee
Splunk Employee

remove the forwarding option, from the UI settings > forwarding and receiving > forwarding , or from the tcpout config in outputs.conf

superiorlabels
Explorer

I checked both the forwarding page and the outputs.conf file and didn't see anything about the receiving machine as a forwarder. Any other setting that might cause this to happen?

0 Karma

somesoni2
Revered Legend

The file name is outputs.conf and the stanza name will be [tcpout... ].

0 Karma

superiorlabels
Explorer

That's my bad there I checked the correct file, outputs.conf, I just typed the wrong thing in my comment, I'll edit the comment.

0 Karma

somesoni2
Revered Legend

Go to Settings-> Forwarding and receiving -> Forward data and remove any entry that you find. Do this for all receivers.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...