Splunk Enterprise

How to remove a linux server from SplunkLight search

New Member


I have a server which I no longer want included in my Splunk Search. The context for this is AWS where we are bringing up new servers and decommission existing servers in a blue/green deployment style. We would like to execute a script on the servers to be decommissioned so that they no longer participate in our Splunk configuration.

Here are the commands I use to add a server to our Splunk configuration:

/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt
/opt/splunkforwarder/bin/splunk install app packages/splunkclouduf.spl -auth admin:$SPLUNK_PASSWORD
/opt/splunkforwarder/bin/splunk set deploy-poll input-prd-p-qhc9rkr77cz2.cloud.splunk.com:8089
/opt/splunkforwarder/bin/splunk restart
/opt/splunkforwarder/bin/splunk enable boot-start

What are the commands to remove the server from our Splunk configuration?

Is it as simple as:
/opt/splunkforwarder/bin/splunk stop

Labels (1)
Tags (1)
0 Karma


If you want to remove splunk agent from your server
1 - If you configured the universal forwarder to start on boot, remove it from your boot scripts before you uninstall.
./splunk disable boot-start

2 - Stop the forwarder
/splunk stop

check this document for further information

Plus this process, you can blacklist the servers you want to remove on the deployment server accessing the server_class they were setup to. So you can guarantee if someone start the splunk service, splunk will not receive new data.

0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...