Running the Customer Success Toolkit's error report I noticed a warning on lots of Universal Forwarders that doesn't make sense to me:
19.01.23 10:49:53,614 |
01-19-2023 10:49:53.614 +0100 WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts
|
19.01.23 10:33:28,659 |
01-19-2023 10:33:28.659 +0100 WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts
|
Our Universal Forwarders have no distsearch.conf.
Any idea why this is reported?
And how to turn it off? We already have enough noise in our data.
Thanks in advance
Volkmar
Hi @vgrote ,
Have you checked this https://community.splunk.com/t5/Getting-Data-In/Unable-to-find-distsearch-conf-file-on-my-system-and.... I’m not 100 sure, but looks like it may help.
Thank You
@vgrote It is a useless Warning for UniversalForwarder. As a workaround to get rid of these log messages you could roll out a distsearch.conf file that contains only the stanza
[distributedSearch]