The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.

Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.

Forums: SplunkAdministration: Non-essential process and how can I stop them in a Distributed Forwarding role

Previous Topic: ASA Bundle?  |   Next Topic: splunkweb ssl cert with chain?


Posts 1–2 of 2
1
posted by: pstein  |  posts
date: March 24, 2008
permalink

I have a client server that is simply forwarding smtp log data via Splunk and Distributed Forward Data. I seem to recall training that spoke to the fact that you can turn off non-essential processes. In this case it appears splunkd-optimize is non-essential being no data is kept locally, but forwarded on. Every once in a while there is a spike in CPU the client does not want to see on him server due to the nature of the server and resources.
Is it possible to turn off non-essential processes?

Regards,

pstein

2
posted by: araitz  |  posts
date: March 24, 2008
permalink

Paul,

You did the following?

./splunk disable webserver
./splunk set server-type forwarder

You can set optimize never to run by creating this entry in local/indexes.conf:

maxConcurrentOptimizes = 0

Keep in mind that this will set optimize never to run, and even on the forwarder you are still doing some indexing (fishbucket for example), so this could have an adverse affect on performance. We are looking in to some forwarder configurations that do not do any indexing at all for just this type of scenario.