Installation

Accidentally deleted auto_generated_pool, will there be any adverse effects?

Erilope
Explorer

Hello everyone, 

I was updating our licenses and I am still new to Splunk, so I accidentally deleted the auto_generated_pool. I recreated the pool to match the auto_generated_one, but I would just like to know if I might have broken anything or if there is anyway to get Splunk to generate another auto_generated_pool? I checked our indexers and I performed a few searches and it looks like we are still gathering data. 

Labels (1)
0 Karma
1 Solution

chaker
Contributor

If you are only using 1 pool, it makes no difference. So long as you have a pool configured, that's all that is needed.

Pool's are used to assign different indexing volumes to different indexers. If all your indexers should be indexing data equally, then a single pool, either auto-generated, or manually created is all you need.

Have a read over this if you have not already:

https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Createalicensepool

 

View solution in original post

chaker
Contributor

If you are only using 1 pool, it makes no difference. So long as you have a pool configured, that's all that is needed.

Pool's are used to assign different indexing volumes to different indexers. If all your indexers should be indexing data equally, then a single pool, either auto-generated, or manually created is all you need.

Have a read over this if you have not already:

https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Createalicensepool

 

Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...