Splunk Enterprise

disable splunk stream

iherb_0718
Path Finder

Anyone have the directions handy to disable splunk stream on a particular server? Is it done via the splunk stream app?

I want to disable it in a way that the service will not start up when the server reboots.

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

This is default group that catches forwarders if no other group matches.

You should create a new group and move your stream setups to new one. Setup match forwarders regex to match only your server that you want. This will be your active configuration point.

Default group should not contain any stream. Your unwanted server will be seen under this default group and does not listen any stream.

 

If this reply helps you an upvote is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @iherb_0718,

You can remove that particular server from Forwarder groups on Splunk Stream App | Distributed Forwarder Management.

Streamfwd service will start but not start listening.

If this reply helps you an upvote is appreciated.
0 Karma

iherb_0718
Path Finder

Within the Stream app < configuration < distributed forwarder management < There is a default group and MATCHED FORWARDERS but that link is not editable. 

 

0 Karma

alonsocaio
Contributor

HI @iherb_0718,

How are you deploying the Splunk Stream app to your servers? Are you using a deployment server? If so, you could try removing your server from the server class that deploys this app. I guess this would uninstall the Splunk Stream app from the server.

0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...