Documentation > Splunk > Admin Manual > Light Weight Splunk-2-Splunk forwarder Configuration

Admin Manual

 


Overview
Setting Up Data Inputs
Authentication
Changing the Way Splunk Processes Your Data
Creating and Using Configuration Bundles
Configuring Your Sources
Splunk-2-Splunk Management
Integration
Managing Your Filesystem
How-To's

Light Weight Splunk-2-Splunk forwarder Configuration

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

Light Weight Splunk-2-Splunk forwarder Configuration

The default Splunk Server configuration is designed for easy setup with most modules and processors turned on. Splunk configurations can be tuned for settings where administrators would prefer Splunk use less system resources, for example, where Splunk is not indexing locally but instead forwarding to another Splunk instance.


Below we show how to minimize the resource footporint for the Splunk server - future versions of Splunk will contain sophisticated packaging and deployment tools to make this easier.


Configurations for light weight forwarder

Turn off all unnecessary modules

Every loaded module takes up a small amount of memory and CPU. For most light weight forwarding installations only the Tailing module is required. Modules are located in the SPLUNK_HOME/etc/modules directory and are loaded by default if they have a config.xml file. To turn off unnecessary modules just rename the config.xml to config.xml.off. This will prevent them from being loaded at startup.


The following is the list of modules included as part of Splunk 2.2. We have noted those modules which you should NOT turn off.


These module should be left on


Remove Unnecessary Processors in Splunkd.xml

Replace your default $SPLUNK_HOME/etc/myinstall/splunkd.xml with this one. 


 splunkd.xml to splunkd.old



 splunkd.xml



 <serverName>server_name_in_splunkd.xml</serverName> with your splunk server


Disable internal logging

By default Splunk will index its own log files to an internal index. You should disable these data inputs by modifying your $SPLUNK_HOME/etc/bundles/default/inputs.conf to include the line disabled = true for each input. 


[tail://$SPLUNK_HOME/var/log/splunk/searchhistory.log]
disabled = true
index = history
[tail://$SPLUNK_HOME/var/log/splunk/web_access.log]
disabled = true
index = _internal
[tail://$SPLUNK_HOME/var/log/splunk/web_service.log]
disabled = true
index = _internal
[tail://$SPLUNK_HOME/var/log/splunk/splunkd.log]
disabled = true
index = _internal
[tail://$SPLUNK_HOME/var/log/splunk/splunklogger.log]
disabled = true
index = splunklogger
Retrieved from "http://docs.splunk.com/Documentation/Splunk/2.2.6/Admin/LightWeightSplunk2SplunkForwarderConfiguration"

This documentation applies to the following versions of Splunk: 2.2 , 2.2.1 , 2.2.3 , 2.2.6 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!