Hi,
To answer your question about the setting: Turning it on means that Splunk no longer attempts to check and see if it can run on your filesystem before starting and indexing data. That means, if your filesystem doesn't do the right things when Splunk attempts to write index buckets, you could potentially lose any data that is contained within those buckets if Splunk can't retrieve them later. This is why it is so important to let Splunk check the filesystem before it starts, because if it doesn't, that means it doesn't understand the layout of the filesystem and is protecting you from that potential data loss.
Like the article says, if you understand these risks and want to index your data anyway, go right ahead. If you have additional copies of the data, or can reindex the data that you have, then there is no real danger. But you should do what you can to make sure that Splunk runs on the filesystem that is on your machine, that means using a supported filesystem.
Of course I'm going to say, use Splunk all day every day for everything 😄 But the answer to that question is dependent on your specific needs. This is a temporary solution to a fairly uncommon problem which can easily be fixed by using Splunk on a supported filesystem on a supported operating system. You should never encounter this problem during normal Splunk usage.
... View more
