topic Re: Convert universal forwarder TO lightweight forwarder in Getting Data In

Convert universal forwarder TO lightweight forwarder

adamw — Thu, 16 Jun 2011 20:31:02 GMT

For various reasons (performance, not picking up files, etc) we are looking to migrate our syslog receiver from a universal forwarder to a lightweight forwarder.

I have installed the lightweight forwarder package and migrated configurations over, but I want to make sure I grab the checkpoint (place-in-the-file-marker) files, so that no repeat data is indexed. Where can I find these files?

As well, are there any additional considerations before I make the switch, anything else that should be copied over or potential pitfalls?

Thanks,
--adam

Re: Convert universal forwarder TO lightweight forwarder

gkanapathy — Thu, 16 Jun 2011 23:20:12 GMT

You need to get at minimum the $SPLUNK_HOME/var/lib/splunk/fishbucket directory. That's sufficient for file monitors. I believe if you use Windows Event Log inputs, there is another location you need to snag as well, but I don't know it off the top of my head.

Re: Convert universal forwarder TO lightweight forwarder

amrit — Fri, 17 Jun 2011 02:08:20 GMT

$SPLUNK_DB/persistentstorage (also for fschange).