Getting Data In

How to disable a particular source temporarily?

karthikeyansure
Explorer

Hi Team,

One of the source throwing more logs and it is consuming more volume, so it leads to the license warning. So I need to the disable the source temporarily. Please help me.

Thanks is advance

Tags (2)

jtacy
Builder

Yes, null queue is an index time transform so it requires a restart.

karthikeyansure
Explorer

Hi Team,

I have tried null queue filtering opting, but eventhough after configuring the same, the indexing is occuring for that source. After configuring the null queue in the props.conf and transforms.conf, is it restart of server is required?

Thanks

0 Karma

yannK
Splunk Employee
Splunk Employee

You can start to disable the input.
And when you want to re-enable it, move the old log files out of the way, to avoid having them be indexed (and causing a peak of volume for historical data)

More advanced techniques involve :

yannK
Splunk Employee
Splunk Employee

yes of course, any indextime/inputtime configuration change in the configuration files require a restart to apply.

karthikeyansure
Explorer

Hi Team,

I have tried null queue filtering opting, but eventhough after configuring the same, the indexing is occuring for that source. After configuring the null queue in the props.conf and transforms.conf, is it restart of server is required?

Thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...