https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-forwarding-the-event-which-has-already-forwarded/m-p/116188#M24258 <P>Hi moohkhol,</P> <P>the default behavior of an universal forwarder is, to continue where it left ..... unless you did set <CODE>crcsalt = &lt;SOURCE&gt;</CODE> for example. This can lead to re-indexing. </P> <P>You could use the <CODE>ignoreOlderThan</CODE> option in inputs.conf to ignore files that are older then your set value.</P> <P>Also, re-indexing will take place if the universal forwarders <CODE>fishbucket</CODE> got cleaned by exectuing <CODE>splunk clean all</CODE> or by removing files form <CODE>$SPLUNK_HOME/var/lib/splunk/fishbucket</CODE>.</P> <P>cheers, MuS</P> Wed, 02 Apr 2014 10:53:59 GMT MuS 2014-04-02T10:53:59Z https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-forwarding-the-event-which-has-already-forwarded/m-p/116187#M24257 <P>Today I have change configuration of forwarder and restarted it, after restart it is forwarding previous events as well which forwarder has already forwarder. </P> <P>How I can make sure that after restart, forwarder will only send latest data not previous one. </P> Wed, 02 Apr 2014 10:15:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-forwarding-the-event-which-has-already-forwarded/m-p/116187#M24257 moohkhol 2014-04-02T10:15:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-forwarding-the-event-which-has-already-forwarded/m-p/116188#M24258 <P>Hi moohkhol,</P> <P>the default behavior of an universal forwarder is, to continue where it left ..... unless you did set <CODE>crcsalt = &lt;SOURCE&gt;</CODE> for example. This can lead to re-indexing. </P> <P>You could use the <CODE>ignoreOlderThan</CODE> option in inputs.conf to ignore files that are older then your set value.</P> <P>Also, re-indexing will take place if the universal forwarders <CODE>fishbucket</CODE> got cleaned by exectuing <CODE>splunk clean all</CODE> or by removing files form <CODE>$SPLUNK_HOME/var/lib/splunk/fishbucket</CODE>.</P> <P>cheers, MuS</P> Wed, 02 Apr 2014 10:53:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-forwarding-the-event-which-has-already-forwarded/m-p/116188#M24258 MuS 2014-04-02T10:53:59Z https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-forwarding-the-event-which-has-already-forwarded/m-p/116189#M24259 <P>I have not set crcsalt in inputs.conf but still i am seeing that, forwarder is sending older data. I have controlled it with ignoreOlderThan =1d but this will still send duplicate data of 1 day. I am using heavy forwarder .. any though on this ??</P> Wed, 02 Apr 2014 11:41:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-avoid-forwarding-the-event-which-has-already-forwarded/m-p/116189#M24259 moohkhol 2014-04-02T11:41:49Z