Deployment Architecture

Splunk 4.1.7: How to disable index database locally on Lightweight forwarders?

vchin111
New Member

We have installed splunk 4.1.7 on linux servers and configured/enabled light weight forwarder to index logs from application/web servers to central splunk index server. By default, splunk is creating 500MB of database when splunk is installed. Since we have enabled lightweight forwarder on spluk clients (application/web servers), it should not index data locally on any of these clients, so how do we disable/reduce the database sizes on splunk clients( where light weight forwarders are enabled)?

Tags (1)
0 Karma

Takajian
Builder

As you know, Splunk Lightweight forwarder does not have index data. You do not need to care about indexed data size.
Enabling Lightweight forwarder means disabling storing data on forwarder.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...