How to disable an index temporarily?

[vrmandadi]

I have an index that I want to disable for some time as a large amount of data is coming from it and it caused a license warning.

Please advise.

[Vijeta · Accepted solution]

@vrmandadi In your indexes.conf under your index stanza , just add disabled = true.
Or via UI go to Indexes -> Action -> Disable

[vrmandadi]

Thank You for you response .Does this setting helps to reduce the license usage?

[Vijeta]

If the data is not indexed it won’t be counted against license .

[vrmandadi]

Thank you.So disabling will not get indexed right?..Just to confirm

[Vijeta]

Yes it won’t get indexed.

[Vijeta]

Also if you have the index enabled again then any data queued up in forwarder will get indexed to it .

[vrmandadi]

So the events dont drop , are they still queued ? .If I want to ignore them and only get those events from the time it is enabled ,how can I do that

[vrmandadi]

https://answers.splunk.com/answers/179987/if-i-disable-an-index-will-events-for-that-index-s.html

[hmarkus]

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/RemovedatafromSplunk#Disable_an_index_wit...

[vrmandadi]

Hello @hmarkus

Thank you for your mail .We have a indexer cluster so on which box do I need to disable it.If I want to disable via CLI .What is that I need to add to that index is it enabled = 1 for that index

[hmarkus]

As @Vijeta mentioned, you can also disable it by adding the disabled = true to your indexes.conf.
In an index cluster I would add the line in the indexes.conf in your app on the Cluster Master, that is used to configure all indexes in your Cluster (in $SPLUNK_HOME/etc/master-apps/), and than push your new configuration bundle.
On a single instance you could use the CLI

[vrmandadi]

@hmarkus .Thank you for your reply .Once I enable back do i get the old events that were already indexed and do I get the data during the index disabled time .

If I want to ignore the data which is queued ,how can I do that and I do get the data whihc was indexed before the index is disabled right?

Thanks in Advance