We have installed splunk 4.1.7 on linux servers and configured/enabled light weight forwarder to index logs from application/web servers to central splunk index server. By default, splunk is creating 500MB of database when splunk is installed. Since we have enabled lightweight forwarder on spluk clients (application/web servers), it should not index data locally on any of these clients, so how do we disable/reduce the database sizes on splunk clients( where light weight forwarders are enabled)?
As you know, Splunk Lightweight forwarder does not have index data. You do not need to care about indexed data size.
Enabling Lightweight forwarder means disabling storing data on forwarder.