Installation
Highlighted

How to disable an index temporarily?

Builder

I have an index that I want to disable for some time as a large amount of data is coming from it and it caused a license warning.

Please advise.

Labels (1)
Highlighted
Highlighted

Re: How to disable a index temporarily

Builder

Hello @hmarkus

Thank you for your mail .We have a indexer cluster so on which box do I need to disable it.If I want to disable via CLI .What is that I need to add to that index is it enabled = 1 for that index

0 Karma
Highlighted

Re: How to disable a index temporarily

Explorer

As @Vijeta mentioned, you can also disable it by adding the disabled = true to your indexes.conf.
In an index cluster I would add the line in the indexes.conf in your app on the Cluster Master, that is used to configure all indexes in your Cluster (in $SPLUNK_HOME/etc/master-apps/), and than push your new configuration bundle.
On a single instance you could use the CLI

0 Karma
Highlighted

Re: How to disable a index temporarily

Builder

@hmarkus .Thank you for your reply .Once I enable back do i get the old events that were already indexed and do I get the data during the index disabled time .

If I want to ignore the data which is queued ,how can I do that and I do get the data whihc was indexed before the index is disabled right?

Thanks in Advance

0 Karma
Highlighted

Re: How to disable a index temporarily

Influencer

@vrmandadi In your indexes.conf under your index stanza , just add disabled = true.
Or via UI go to Indexes -> Action -> Disable

View solution in original post

Highlighted

Re: How to disable a index temporarily

Builder

Thank You for you response .Does this setting helps to reduce the license usage?

0 Karma
Highlighted

Re: How to disable a index temporarily

Influencer

If the data is not indexed it won’t be counted against license .

0 Karma
Highlighted

Re: How to disable a index temporarily

Builder

Thank you.So disabling will not get indexed right?..Just to confirm

0 Karma
Highlighted

Re: How to disable a index temporarily

Influencer

Yes it won’t get indexed.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.