topic Re: where was the checkpoints stored to allow splunk forwarder to skip events already sent earlier in case of reboot Splunk forwarder in Getting Data In https://community.splunk.com/t5/Getting-Data-In/where-was-the-checkpoints-stored-to-allow-splunk-forwarder-to/m-p/454234#M78638 <P>Thanks for the clarification.</P> <P>One more query ,if same event is being transffered towards splunk enterprise but from different sourc ,will it check in fishbucket?</P> Mon, 26 Aug 2019 10:18:20 GMT msmita 2019-08-26T10:18:20Z where was the checkpoints stored to allow splunk forwarder to skip events already sent earlier in case of reboot Splunk forwarder https://community.splunk.com/t5/Getting-Data-In/where-was-the-checkpoints-stored-to-allow-splunk-forwarder-to/m-p/454232#M78636 <P>Hi All,</P> <P>Wanted to know ,is there any checkpoint stored to allow splunk forwarder to skip events already sent earlier after reboot the spunk forwarder.I am using version 7.1.4.</P> <P>and if its not skipping earlier events ,Is there an alternative way of removing duplications?</P> <P>Kindly do the needful.</P> Tue, 20 Aug 2019 09:20:27 GMT https://community.splunk.com/t5/Getting-Data-In/where-was-the-checkpoints-stored-to-allow-splunk-forwarder-to/m-p/454232#M78636 msmita 2019-08-20T09:20:27Z Re: where was the checkpoints stored to allow splunk forwarder to skip events already sent earlier in case of reboot Splunk forwarder https://community.splunk.com/t5/Getting-Data-In/where-was-the-checkpoints-stored-to-allow-splunk-forwarder-to/m-p/454233#M78637 <P>Hi,</P> <P>When SplunkForwarder read file, it stores checkpoint(CRC) in fishbucket. Even after splunk service restart SplunkForwarder has all those checkpoint information in fishbucket.</P> <P>Have a look at documentation <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Howlogfilerotationishandled">https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Howlogfilerotationishandled</A> so that you'll get idea how splunk reads rolling log files and how it calculates CRC.</P> Tue, 20 Aug 2019 12:58:18 GMT https://community.splunk.com/t5/Getting-Data-In/where-was-the-checkpoints-stored-to-allow-splunk-forwarder-to/m-p/454233#M78637 harsmarvania57 2019-08-20T12:58:18Z Re: where was the checkpoints stored to allow splunk forwarder to skip events already sent earlier in case of reboot Splunk forwarder https://community.splunk.com/t5/Getting-Data-In/where-was-the-checkpoints-stored-to-allow-splunk-forwarder-to/m-p/454234#M78638 <P>Thanks for the clarification.</P> <P>One more query ,if same event is being transffered towards splunk enterprise but from different sourc ,will it check in fishbucket?</P> Mon, 26 Aug 2019 10:18:20 GMT https://community.splunk.com/t5/Getting-Data-In/where-was-the-checkpoints-stored-to-allow-splunk-forwarder-to/m-p/454234#M78638 msmita 2019-08-26T10:18:20Z Re: where was the checkpoints stored to allow splunk forwarder to skip events already sent earlier in case of reboot Splunk forwarder https://community.splunk.com/t5/Getting-Data-In/where-was-the-checkpoints-stored-to-allow-splunk-forwarder-to/m-p/454235#M78639 <P>No, it will not check. CRC stored in fishbucket for every file you monitor using SplunkForwarder.</P> Mon, 26 Aug 2019 11:47:10 GMT https://community.splunk.com/t5/Getting-Data-In/where-was-the-checkpoints-stored-to-allow-splunk-forwarder-to/m-p/454235#M78639 harsmarvania57 2019-08-26T11:47:10Z