topic Re: UF needs to be restarted every time to get data in Getting Data In

UF needs to be restarted every time to get data

vikram_m — Tue, 12 Dec 2017 14:34:15 GMT

We have configured our UFs to send data from a particular folder.

But every time the UF need to be stopped and started again after which it starts sending data.

I am also surprised why this is the kind of behavior as it is not feasible idea to restart the services every time whenever we want to get data into Splunk.

Re: UF needs to be restarted every time to get data

micahkemp — Tue, 12 Dec 2017 14:44:17 GMT

Splunk requires a restart when making changes to inputs (or other index-time configurations) are made. There is some documentation on this, but I didn't see any reference to input changes specifically. I have submitted feedback that it be included.

Edit: this answer assumes you are referencing adding new data to splunk, not just when new files are made available that should already be handled by an existing input.

Re: UF needs to be restarted every time to get data

skoelpin — Tue, 12 Dec 2017 14:48:46 GMT

What does /opt/splunkforwarder/var/log/splunk/splunkd.log on the UF say?