Installation

How to disable an index temporarily?

Builder

I have an index that I want to disable for some time as a large amount of data is coming from it and it caused a license warning.

Please advise.

Labels (1)
1 Solution

Influencer

@vrmandadi In your indexes.conf under your index stanza , just add disabled = true.
Or via UI go to Indexes -> Action -> Disable

View solution in original post

Influencer

@vrmandadi In your indexes.conf under your index stanza , just add disabled = true.
Or via UI go to Indexes -> Action -> Disable

View solution in original post

Builder

Thank You for you response .Does this setting helps to reduce the license usage?

0 Karma

Influencer

If the data is not indexed it won’t be counted against license .

0 Karma

Builder

Thank you.So disabling will not get indexed right?..Just to confirm

0 Karma

Influencer

Yes it won’t get indexed.

0 Karma

Influencer

Also if you have the index enabled again then any data queued up in forwarder will get indexed to it .

0 Karma

Builder

So the events dont drop , are they still queued ? .If I want to ignore them and only get those events from the time it is enabled ,how can I do that

0 Karma

Builder

Hello @hmarkus

Thank you for your mail .We have a indexer cluster so on which box do I need to disable it.If I want to disable via CLI .What is that I need to add to that index is it enabled = 1 for that index

0 Karma

Explorer

As @Vijeta mentioned, you can also disable it by adding the disabled = true to your indexes.conf.
In an index cluster I would add the line in the indexes.conf in your app on the Cluster Master, that is used to configure all indexes in your Cluster (in $SPLUNK_HOME/etc/master-apps/), and than push your new configuration bundle.
On a single instance you could use the CLI

0 Karma

Builder

@hmarkus .Thank you for your reply .Once I enable back do i get the old events that were already indexed and do I get the data during the index disabled time .

If I want to ignore the data which is queued ,how can I do that and I do get the data whihc was indexed before the index is disabled right?

Thanks in Advance

0 Karma