I have Splunk universal forwarder installed on my hosts. I want to disable this host from sending any data to the indexer and I do not want it to respond to any of the scheduled searches or alerts. How do I get this done? Kindly help.
Also what does the below command do?
./splunk disable app SplunkUniversalForwarder
That depends on what platform you are running on. (You don't specify.)
On a *ix (e.g. Linux) it is as simple as disabling the service and then stopping id.
sudo /etc/init.d/splunk stop sudo ~splunk/bin/splunk disable boot-start
I imagine on Windows it is similar (stop the service, with the Windows interface, then get Splunk to do the boot-start disable).