Installation

If I disable an index, will events for that index stop being counted against the license?

Bill_B
Communicator

This seems like a silly question, but I just want confirmation. I have a huge amount of events coming in for "ontap" index and it is causing license warnings. I would like to halt the indexing of these events until I can properly restrict the amount of events I am receiving. Will disabling the "ontap" index stop these events from being counted against the license?

Thanks.

Labels (1)
0 Karma
1 Solution

aholzer
Motivator

Disabling an index will cause all events that are sent for that index to be dropped by the index. You will receive this error message:
"received event for unconfigured/disabled index=XYZ"

Because it stops indexing events, it will not count towards your license.

I just want to emphasize that if you disable the index you will NOT index any events sent to that index. It will drop the events and not store them anywhere. When you reenable the index, any NEW events will be indexed, and all your old events will still be available. But anything for the time while the index was disabled will not be available.

Hope this helps.

View solution in original post

aholzer
Motivator

Disabling an index will cause all events that are sent for that index to be dropped by the index. You will receive this error message:
"received event for unconfigured/disabled index=XYZ"

Because it stops indexing events, it will not count towards your license.

I just want to emphasize that if you disable the index you will NOT index any events sent to that index. It will drop the events and not store them anywhere. When you reenable the index, any NEW events will be indexed, and all your old events will still be available. But anything for the time while the index was disabled will not be available.

Hope this helps.

Bill_B
Communicator

Thanks aholzer. That's exactly how I thought it would work, but wanted confirmation.

0 Karma

Bill_B
Communicator

Also, any suggestions on what events to discard from NetApp: ONTAP data would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...