./splunk disable app SplunkUniversalForwarder --> How does this work?

[sarnagar]

Hi All,

I have Splunk universal forwarder installed on my hosts. I want to disable this host from sending any data to the indexer and I do not want it to respond to any of the scheduled searches or alerts. How do I get this done? Kindly help.

Also what does the below command do?
./splunk disable app SplunkUniversalForwarder

[grijhwani]

That depends on what platform you are running on. (You don't specify.)

On a *ix (e.g. Linux) it is as simple as disabling the service and then stopping id.

sudo /etc/init.d/splunk stop
sudo ~splunk/bin/splunk disable boot-start

I imagine on Windows it is similar (stop the service, with the Windows interface, then get Splunk to do the boot-start disable).

[andrewpappas]

Should be:
sudo ~splunk/bin/splunk disable boot-start

[grijhwani]

Indeed it should - duly corrected.