topic Re: Is it essential to restart splunk universal forwarder after deletion of monitored logs? in Getting Data In

Is it essential to restart splunk universal forwarder after deletion of monitored logs?

dantimola — Tue, 11 Jul 2017 06:27:52 GMT

Hello fellow ninjas,

Good day. I'd like to ask if splunk uf restart is essential after I deleted a log file that is being monitored by splunk? Because, every time I delete the file, splunk is still reading it resulting high resources usage.

Thanks,
Dan

Re: Is it essential to restart splunk universal forwarder after deletion of monitored logs?

gcusello — Tue, 11 Jul 2017 07:53:31 GMT

Hi dantimola,
no, If you change some log file you can continue to use your UF without restarting it.
you need to restart Splunk Universal Forwarder only if you change some .conf file.

Bye.
Giuseppe

Re: Is it essential to restart splunk universal forwarder after deletion of monitored logs?

koshyk — Tue, 11 Jul 2017 08:08:27 GMT

which version of SplunkUF you using? it might be a bug sometimes

Re: Is it essential to restart splunk universal forwarder after deletion of monitored logs?

dantimola — Wed, 12 Jul 2017 03:06:23 GMT

Thanks for your answer. My case is that, even we deleted the log file, splunk is still reading it as seen on the screenshot I've provided. What could be the problem?

Re: Is it essential to restart splunk universal forwarder after deletion of monitored logs?

dantimola — Wed, 12 Jul 2017 03:07:14 GMT

Hi, its universal forwarder 6.2.6 and 6.4.0

Re: Is it essential to restart splunk universal forwarder after deletion of monitored logs?

gcusello — Thu, 13 Jul 2017 07:32:33 GMT

Hi dantimola,
until you don't disable it, Splunk input is waiting for a new file or variation of it.

Bye.
Giuseppe

Re: Is it essential to restart splunk universal forwarder after deletion of monitored logs?

dantimola — Tue, 25 Jul 2017 03:41:13 GMT

I saw migration.conf in the uf. Is it possible that it was the culprit why the issue is occuring?