Installation

If I disable an index, will events for that index stop being counted against the license?

Bill_B
Communicator

This seems like a silly question, but I just want confirmation. I have a huge amount of events coming in for "ontap" index and it is causing license warnings. I would like to halt the indexing of these events until I can properly restrict the amount of events I am receiving. Will disabling the "ontap" index stop these events from being counted against the license?

Thanks.

Labels (1)
0 Karma
1 Solution

aholzer
Motivator

Disabling an index will cause all events that are sent for that index to be dropped by the index. You will receive this error message:
"received event for unconfigured/disabled index=XYZ"

Because it stops indexing events, it will not count towards your license.

I just want to emphasize that if you disable the index you will NOT index any events sent to that index. It will drop the events and not store them anywhere. When you reenable the index, any NEW events will be indexed, and all your old events will still be available. But anything for the time while the index was disabled will not be available.

Hope this helps.

View solution in original post

aholzer
Motivator

Disabling an index will cause all events that are sent for that index to be dropped by the index. You will receive this error message:
"received event for unconfigured/disabled index=XYZ"

Because it stops indexing events, it will not count towards your license.

I just want to emphasize that if you disable the index you will NOT index any events sent to that index. It will drop the events and not store them anywhere. When you reenable the index, any NEW events will be indexed, and all your old events will still be available. But anything for the time while the index was disabled will not be available.

Hope this helps.

Bill_B
Communicator

Thanks aholzer. That's exactly how I thought it would work, but wanted confirmation.

0 Karma

Bill_B
Communicator

Also, any suggestions on what events to discard from NetApp: ONTAP data would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...