Installation

Accidentally deleted auto_generated_pool, will there be any adverse effects?

Erilope
Explorer

Hello everyone, 

I was updating our licenses and I am still new to Splunk, so I accidentally deleted the auto_generated_pool. I recreated the pool to match the auto_generated_one, but I would just like to know if I might have broken anything or if there is anyway to get Splunk to generate another auto_generated_pool? I checked our indexers and I performed a few searches and it looks like we are still gathering data. 

Labels (1)
0 Karma
1 Solution

chaker
Contributor

If you are only using 1 pool, it makes no difference. So long as you have a pool configured, that's all that is needed.

Pool's are used to assign different indexing volumes to different indexers. If all your indexers should be indexing data equally, then a single pool, either auto-generated, or manually created is all you need.

Have a read over this if you have not already:

https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Createalicensepool

 

View solution in original post

chaker
Contributor

If you are only using 1 pool, it makes no difference. So long as you have a pool configured, that's all that is needed.

Pool's are used to assign different indexing volumes to different indexers. If all your indexers should be indexing data equally, then a single pool, either auto-generated, or manually created is all you need.

Have a read over this if you have not already:

https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Createalicensepool

 

Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...