topic Re: Splunk UF after Sleep/Hibernate in Getting Data In

Splunk

Priya70 — Wed, 29 Jan 2025 22:50:18 GMT

n/a

Re: Splunk UF after Sleep/Hibernate

isoutamo — Mon, 30 Dec 2024 14:00:38 GMT

Can you paste your inputs.conf here between editor's script block </> ?

When you are saying "cheduled runs are sometimes missed, or scripts execute at unexpected times." is the only fix for this to restart splunkd service on UF?

Are those UFs in domain or just individual nodes which manages time sync with ntpd instead of Windows domain service?

Re: Splunk UF

Priya70 — Thu, 02 Jan 2025 16:19:23 GMT

N.A

Re: Splunk UF after Sleep/Hibernate

isoutamo — Tue, 31 Dec 2024 07:13:54 GMT

This should works correctly.
When you are saying “restart UF”, are you meaning splunk UF process or whole windows node?
Any reason why you are using separate ntpd instead of domain time? Have you checked how big time difference is after hibernation? You are aware that there are limits how big time difference ntpd can manage by itself without additional synchronization?

Re: Splunk UF after Sleep/Hibernate

Priya70 — Thu, 02 Jan 2025 16:20:06 GMT

N.A

Re: Splunk UF after Sleep/Hibernate

isoutamo — Tue, 31 Dec 2024 15:33:51 GMT

How quickly that sw update node’s time to correct after hibernation? Basically after that UF’s cron schedule should work as expected. If not then I propose that you should create a support case to Splunk.

Re: Splunk UF after Sleep/Hibernate

Priya70 — Thu, 02 Jan 2025 16:20:42 GMT

N.A

Re: Splunk UF after Sleep/Hibernate

isoutamo — Tue, 31 Dec 2024 17:01:20 GMT

So UF recognize the change of time when it writes this message into log, but its scheduler didn’t understand it correctly to run next round at correct time. Definitely time to create splunk support case.

Re: Splunk UF after Sleep/Hibernate

Priya70 — Thu, 02 Jan 2025 16:21:04 GMT

N/A