topic Re: Re-send data with universal forwarder? in Getting Data In

Re-send data with universal forwarder?

kevintelford — Thu, 07 Apr 2011 03:31:16 GMT

When using a lightweight-forwarder we were able to clean the fishbucket (eventdata) so that we could re-forward data. Trying this on the new universal forwarder yields the message "ERROR: Cleaning eventdata is not supported on this version." Is there a new way to do this?

Thanks, Kevin

Re: Re-send data with universal forwarder?

amrit — Thu, 07 Apr 2011 09:34:34 GMT

There is currently no command that will clean only the fishbucket (this is a bug, lack of foresight, something). You should file an ER for this, but in the meantime you can just wipe the contents of $SPLUNK_DB/var/lib/splunk/fishbucket/ .

Re: Re-send data with universal forwarder?

kevintelford — Thu, 07 Apr 2011 22:51:04 GMT

Submitted: Case # 57213

Re: Re-send data with universal forwarder?

amrit — Sat, 09 Apr 2011 00:16:13 GMT

You want a cookie?

Re: Re-send data with universal forwarder?

cervelli — Wed, 20 Jul 2011 18:27:22 GMT

The clean all command works for removing the fishbucket on a UF. Is there a reason you can't issue that command?

Re: Re-send data with universal forwarder?

gkanapathy — Wed, 20 Jul 2011 20:19:50 GMT

I don't know his problem, but I guess this would wipe/reset the user/password data, wouldn't it?

Re: Re-send data with universal forwarder?

tonopahtaos — Thu, 02 Aug 2012 21:17:37 GMT

This did not work for me. When UF was running, i got a error when I wiped out the content of 'fishbucket'. I have to stop UF first, then remove all under 'fishbucket'. After restarting UF, i did not see any admon or Windows audit event resent.

Re: Re-send data with universal forwarder?

tonopahtaos — Thu, 02 Aug 2012 21:32:13 GMT

Here is why:

C:\Program Files\SplunkUniversalForwarder\bin>splunk clean eventdata
This action will permanently erase all events from ALL indexes; it cannot be und
one.
Are you sure you want to continue [y/n]? y
ERROR: Cleaning eventdata is not supported on this version.

Re: Re-send data with universal forwarder?

gkanapathy — Tue, 28 Aug 2012 23:49:07 GMT

cervelli said clean all. not clean eventdata.

Re: Re-send data with universal forwarder?

kevin_telford — Wed, 15 Jul 2015 18:41:02 GMT

Four plus years and still no cookie. Hopefully you don't treat all the ladies this way.

Re: Re-send data with universal forwarder?

ferenc0521 — Thu, 24 May 2018 21:21:17 GMT

clean all removed all user data, including admin. I cannot add admin back, because it requires authorization.
catch 22

Re: Re-send data with universal forwarder?

ferenc0521 — Thu, 24 May 2018 21:50:52 GMT

so tried clean all, but didn't see the files/events resent, moreover the admin user is gone, so
can't check with:
https://:8089/services/admin/inputstatus/TailingProcessor:FileStatus
because no auth with admin is possible.

I guess reinstall/config is next step