How to Turn off indexing on dedicated search head?

[JBarkerMox]

Splunk Deployment Document Page 98 states:
6. Set up the authentication method you want to use on the search head, just as you would for any
other Splunk instance. Do not set up any indexing on your search head, since that will violate its
license.

Exactly how do you turn off indexing on the search head?

[JBarkerMox]

This did not work for me. Splunk started behaving badly when I tried.
I figured out if you enable forwarding before defining and inputs, especially on the local box, then the search head does not start indexing. One thing I did get from this, as a newbie, was to always restart Splunk afetr making changes!! Thanks.

[splunkIT]

Be very careful when considering enabling SplunkLightForwarder app on the search head, as it will disable scheduled searches, and other functionalities:

http://splunk-base.splunk.com/answers/89515/oh-crap-scheduled-searches-have-stopped-running-without-...

[yannK]

The best method to achieve this is to turn your search-head into a LightWeightforwarder (will forward any data, including summary indexes to the indexers)

they are 3 tricky steps :

• 1 make sure that all the indexes existing on the search-head are defined on the indexers too (in particular the summary indexes)

• 2 turn on the SplunklightForwarder app on the search-head (specify the splunktcp port of the indexer, or of the cluster if you have load balancing)
  BUT this will turn off the web interface (splunkweb)
  REMARK : using the regular forwarder will not prevent the search-head to parse the events
  locally before forwading them.

• 3 turn on the web interface that was shut down
  edit $SPLUNK_HOME/etc/system/local/web.conf
  

  
  
  [settings]
  
  startwebserver = 1
  
  

  
  and restart to apply

Enjoy.

[yannK]

yes, probably.

[bmacias84]

@yannK, Does this still apply to 5.0.1