topic Re: Universal Forwarder resending event log data in Getting Data In

Universal Forwarder resending event log data

splunkjas1 — Fri, 12 Jan 2018 16:12:31 GMT

If the IP address for a host changes or if it gets a new GUID, would the forwarder resend the entire Windows event log?

Re: Universal Forwarder resending event log data

somesoni2 — Fri, 12 Jan 2018 17:05:57 GMT

Is your forwarder resending event logs again? Has any specific activity was performed on your UF like version upgrade?

Re: Universal Forwarder resending event log data

splunkjas1 — Fri, 12 Jan 2018 17:08:15 GMT

The forwarders are resending event logs. We upgraded them from 6.4.4 to 6.4.9. Would the upgrade cause logs to be resent?

Re: Universal Forwarder resending event log data

nickhills — Fri, 12 Jan 2018 17:19:08 GMT

It depends.
If you uninstalled the old forwarder and then reinstalled the new one, it’s quite possible that it will re-read and send all the logs.

If you upgraded the forwarder this should not occurr, even if the ip or guild changes.

Re: Universal Forwarder resending event log data

somesoni2 — Fri, 12 Jan 2018 17:21:17 GMT

It should'nt. How did you do the upgrade (procedure)? Was it it inline with what this Splunk documentation suggests?
https://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/UpgradetheWindowsuniversalforwarder#Upgrade_a_single_forwarder_using_the_command_line

Re: Universal Forwarder resending event log data

splunkjas1 — Fri, 12 Jan 2018 17:24:50 GMT

I asked the folks who performed the upgrade and they told me they do uninstall the 6.4.4 version before installing 6.4.9. So that's probably what caused the logs to be resent, would you agree?

Re: Universal Forwarder resending event log data

nickhills — Fri, 12 Jan 2018 17:27:02 GMT

Yes. In that case I would say it’s expected behaviour

Re: Universal Forwarder resending event log data

splunkjas1 — Fri, 12 Jan 2018 17:28:57 GMT

Okay, thank you.

Re: Universal Forwarder resending event log data

nickhills — Fri, 12 Jan 2018 17:32:08 GMT

I converted my comment to an answer, so you can accept it if it helped

Re: Universal Forwarder resending event log data

nickhills — Fri, 12 Jan 2018 17:34:33 GMT

I noted “possible” because depending on your config, it may elect to only send evens which are older than x days, or in the case of windows events, only while the forwarder is running. Neither of these are default config, and have drawbacks.