I stupidly enabled Lightweight forwarding from the web interface and now I can't get the web interference to load. How can I Disable lightweight forwarding from Linux command line so that I can get things back to normal. I'm using 4.1 so the set server-type no longer works.
In the app.conf file located in your etc\apps\SplunkLightForwarder\local
folder adjust the settings to:
[install]
state = disabled
and then restart your Splunk instance, this will do the trick.
splunk disable app SplunkLightForwarder
will do the trick as well
I finally found the documentation for this feature for v4.1. http://www.splunk.com/base/Documentation/4.1.2/Admin/Enableforwardingandreceiving
./splunk disable app [SplunkForwarder|SplunkLightForwarder] -auth [username]:[password]
In the app.conf file located in your etc\apps\SplunkLightForwarder\local
folder adjust the settings to:
[install]
state = disabled
and then restart your Splunk instance, this will do the trick.
splunk disable app SplunkLightForwarder
will do the trick as well