Re-send data with universal forwarder?

[kevintelford]

When using a lightweight-forwarder we were able to clean the fishbucket (eventdata) so that we could re-forward data. Trying this on the new universal forwarder yields the message "ERROR: Cleaning eventdata is not supported on this version." Is there a new way to do this?

Thanks, Kevin

[cervelli]

The clean all command works for removing the fishbucket on a UF. Is there a reason you can't issue that command?

[gkanapathy]

cervelli said clean all. not clean eventdata.

[ferenc0521]

clean all removed all user data, including admin. I cannot add admin back, because it requires authorization.
catch 22

[ferenc0521]

so tried clean all, but didn't see the files/events resent, moreover the admin user is gone, so
can't check with:
https://:8089/services/admin/inputstatus/TailingProcessor:FileStatus
because no auth with admin is possible.

I guess reinstall/config is next step

[tonopahtaos]

Here is why:

C:\Program Files\SplunkUniversalForwarder\bin>splunk clean eventdata
This action will permanently erase all events from ALL indexes; it cannot be und
one.
Are you sure you want to continue [y/n]? y
ERROR: Cleaning eventdata is not supported on this version.

[gkanapathy]

I don't know his problem, but I guess this would wipe/reset the user/password data, wouldn't it?

[amrit · Accepted solution]

There is currently no command that will clean only the fishbucket (this is a bug, lack of foresight, something). You should file an ER for this, but in the meantime you can just wipe the contents of $SPLUNK_DB/var/lib/splunk/fishbucket/ .

[tonopahtaos]

This did not work for me. When UF was running, i got a error when I wiped out the content of 'fishbucket'. I have to stop UF first, then remove all under 'fishbucket'. After restarting UF, i did not see any admon or Windows audit event resent.

[amrit]

You want a cookie?

[kevin_telford]

Four plus years and still no cookie. Hopefully you don't treat all the ladies this way.

[kevintelford]

Submitted: Case # 57213