Deployment Architecture

Splunk 4.1.7: How to disable index database locally on Lightweight forwarders?

vchin111
New Member

We have installed splunk 4.1.7 on linux servers and configured/enabled light weight forwarder to index logs from application/web servers to central splunk index server. By default, splunk is creating 500MB of database when splunk is installed. Since we have enabled lightweight forwarder on spluk clients (application/web servers), it should not index data locally on any of these clients, so how do we disable/reduce the database sizes on splunk clients( where light weight forwarders are enabled)?

Tags (1)
0 Karma

Takajian
Builder

As you know, Splunk Lightweight forwarder does not have index data. You do not need to care about indexed data size.
Enabling Lightweight forwarder means disabling storing data on forwarder.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...