Getting Data In

Logging, Splunkforwarder, and Diskless Servers

stl
New Member

I've got a bunch of server which boot entirely without local disk. Is there a means to disable splunkforwarder from wanting to write any log files? As they're pushing data to the indexers for retention it would be excellent if possible.

Tags (2)
0 Karma

nterry
Path Finder
0 Karma

kristian_kolb
Ultra Champion

Sorry, I don't have an answer to your question, but could you not use a RAM disk or log to some NAS/SAN/ordinary network share, or even syslog?

/k

0 Karma

josephnoall
Engager

I've got the same problem, anybody have an answer for this?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...