I've got a bunch of server which boot entirely without local disk. Is there a means to disable splunkforwarder from wanting to write any log files? As they're pushing data to the indexers for retention it would be excellent if possible.
I'm having this issue too.
http://splunk-base.splunk.com/answers/42560/logcfg-appenders-list-or-other-ways-of-routing-internal-...
Sorry, I don't have an answer to your question, but could you not use a RAM disk or log to some NAS/SAN/ordinary network share, or even syslog?
/k
I've got the same problem, anybody have an answer for this?
