Deployment Architecture

Splunk 4.1.7: How to disable index database locally on Lightweight forwarders?

vchin111
New Member

We have installed splunk 4.1.7 on linux servers and configured/enabled light weight forwarder to index logs from application/web servers to central splunk index server. By default, splunk is creating 500MB of database when splunk is installed. Since we have enabled lightweight forwarder on spluk clients (application/web servers), it should not index data locally on any of these clients, so how do we disable/reduce the database sizes on splunk clients( where light weight forwarders are enabled)?

Tags (1)
0 Karma

Takajian
Builder

As you know, Splunk Lightweight forwarder does not have index data. You do not need to care about indexed data size.
Enabling Lightweight forwarder means disabling storing data on forwarder.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...