Relation between fishbuckets and check point files.

sunrise — Wed, 25 Dec 2013 00:27:08 GMT

Hi Splunkers,

I know that Universal Forwarder monitoring windows eventlog has a check point file and fishbuckets.
In re-transferring data to the Indexer, we have two cases.

For example, it seems to be two cases.
1. Delete fishbuckets, not changing check points files.
2. Change check point files, not deleting fishbuckets.

Case 1, in default setting, UF seems to transfer all local eventlog to Indexer.

Case 2, we actually can set a record ID from which start to read.

But I cannot understand these logic.
Does UF read check point file and start transferring data irrelevant to fishbuckets ?
Or does UF not transfer data in spite of changing the check point file because of fishbuckets ?

Thak you for your help.

Re: Relation between fishbuckets and check point files.

gkanapathy — Wed, 25 Dec 2013 04:13:00 GMT

Checkpoint files are used to track position in the windows event logs. The fish bucket is used to track position in files (read by the monitor:// input processor). A particular input type uses either one or the other.

topic Relation between fishbuckets and check point files. in Getting Data In

Relation between fishbuckets and check point files.

Re: Relation between fishbuckets and check point files.