topic Splunk UF Backlog in Getting Data In

Splunk UF Backlog

johann2017 — Wed, 27 Nov 2019 15:58:15 GMT

Hey everyone, quick UF question here... If a UF stops for whatever reason then comes back on later on, will the UF send the backlogs it missed while the service went offline?

Re: Splunk UF Backlog

gcusello — Wed, 27 Nov 2019 16:09:11 GMT

Hi @johann2017,
yes: if connection with Indexer is interrupted, UF locally caches logs and send them as soon as connection is restored.

If it's the UF itself to stop, when it restarts it ingest all the logs from the last ingested.

There's only one situation when logs are lost and it's when I use an Heavy Forwarder to ingest syslogs but it's out of scope of your question.

Ciao.
Giuseppe

Re: Splunk UF Backlog

richgalloway — Wed, 27 Nov 2019 16:09:33 GMT

Yes, UFs will pick up where they left off.

Re: Splunk UF Backlog

johann2017 — Wed, 27 Nov 2019 16:17:20 GMT

Thank you rich!