Getting Data In

How can I prevent reindexing events after a reinstall of universal forwarder

gesa_behrens
Path Finder

I am working on a docker for a universal forwarder. The docker worked well until I reconfigured it for automatic restart.
This forwarder monitors a file outside of the docker.
Now when I restart the docker, the forwarder (as far as I understand the system) will reread the whole file because there is no 'last-read-mark' in a newly build forwarder. Because of this I set followTail=1. Missing a few events in our scenario is not as bad as having all old events double. But now I do not get any events at all.
The file I am monitoring does not have very much traffic, only about 500 entries per day.
In internal index I found the following entries like this for my monitored file, but cannot interpret them :
07-11-2019 09:15:48.586 +0000 INFO Metrics - group=per_source_thruput, series="/dataqualityservices/logs/behaviour.log", kbps=0.02759523914898141, eps=0.09677234550875673, kb=0.85546875, ev=3, avg_age=0.6666666666666666, max_age=2

Can someone help me here please?

0 Karma
1 Solution

tiagofbmm
Influencer

You can save the fishbucket database from $SPLUNK_HOME/var/lib/fishbucket and replace it in the new instance

View solution in original post

0 Karma

tiagofbmm
Influencer

You can save the fishbucket database from $SPLUNK_HOME/var/lib/fishbucket and replace it in the new instance

0 Karma

gesa_behrens
Path Finder

Thanks for the quick answer, I will try that.
I have encountered another problem in the meantime which I have to solve first, so it will take a while until I can do that

0 Karma

gesa_behrens
Path Finder

tried it and worked, thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...