- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Universal forwarder stopped suddenly. but not fetc...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Universal forwarder stopped suddenly. but not fetching the data where it got stopped after restart
hi..
in one of my windows server the universal forwarder stopped unexpected. found and restarted the universal forwarder after a day, but the universal forwarder sending the logs from the universal forwarder start time, what about my previous logs i mean 1 day logs
should i have to configure any attribute to get this done
anyone please suggest
Many Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm getting the same problem. Splunk Universal Forwarder on Linux, accessing file data. When the forwarder stops working, we restart the forwarder and it ingests data again, but not for that entire gap that it was down.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Aha - Found it in apps/search:
-bash-3.2$ more inputs.conf
[monitor:///logs/remote/.../*.log]
disabled = false
index = issec
sourcetype = syslog
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great. Either comment the entry (put # in front of each line) OR set disabled = true. Restart Splunk forwarder after making the change and it should be sending data for this log file to indexers anymore.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, here is the entire contents of the inputs.conf:
-bash-3.2$ more inputs.conf
[default]
host = tuslplog01
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's weird... This is a syslog server, but the data is file based, but I can't see where the inputs are defined...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run below command and see what all different inputs.conf you have. (assuming UF is installed /opt/splunkforwarder directory, update if it's different)
/opt/splunkforwarder/bin/splunk cmd btool inputs list --debug
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You don't use ignoreOlderThan in your inputs stanza, right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good point.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What type of logs are showing gaps, file monitoring, scripted inputs etc?? If it's file monitoring, then check, when the forwarder started working again, if the log files did contain the data which is not been shown. If the files are rolled over, they may not get monitored. If it's a scripted, scheduled inputs, they there won't be any backfill and it'll show the gaps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
By default the UF should continue where it left before stopping. This is the default behaviour, nothing to configure to get this.
What kind of inputs are you using? Is the missing data persisted on the server, so UF can read it? Maybe it has been rolled before the restart of the UF...
Regards
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
