topic Re: When does the Splunk forwarder empty the /splunkforwarder/var/spool/splunk directory? in Getting Data In

When does the Splunk forwarder empty the /splunkforwarder/var/spool/splunk directory?

othersider2 — Tue, 29 Sep 2020 22:40:47 GMT

I performed a Splunk forwarder spool command to send a log file to Splunk Enterprise. The command made a copy of the log file and placed it into the $SPLUNK_HOME/splunkforwarder/var/spool/splunk directory. The log file was then successfully sent to the Enterprise sever. I was expecting that after the log file was successfully sent, that it would then be deleted from the $SPLUNK_HOME/splunkforwarder/var/spool/splunk directory. But the log file is still there.

Isn't the Splunk forwarder supposed to delete spooled files after a successful send? If so, what must I do to configure this, since it isn't happening out of the box?

Re: When does the Splunk forwarder empty the /splunkforwarder/var/spool/splunk directory?

MuS — Wed, 09 Jan 2019 20:04:06 GMT

Hi othersider2,

check splunkd.log of the universal forwarder for error messages related to this file. Most likely a permission issue, and the UF is not able to delete the file.

cheers, MuS

Re: When does the Splunk forwarder empty the /splunkforwarder/var/spool/splunk directory?

bangalorep — Thu, 10 Jan 2019 10:04:23 GMT

Hello,
You could try this https://answers.splunk.com/answers/294682/the-splunk-homevarspoolsplunk-directory-is-filling.html