I no longer wanted any data with index=windows, so I disabled it. However, I am still receiving data targeted at it. How can I avoid this ?
I know, I can set the receiving logs to nullqueue, but I wanted to do it the easy way as Splunk doc already states "once an index is disabled, splunkd will no longer accept data targeted at it"
Why am I still receiving data ?
↧