topic Re: No previous events when UF are installed in Getting Data In

No previous events when UF are installed

jonwick — Mon, 19 Oct 2020 08:14:27 GMT

Hi Splunkers,

When UFs are installed, I don't want them to send all the events which were generated prior to UF was installed.

I just want UF to start sending logs when it was installed.

Is there a way to conf this?

To be honest we need to reinstall UFs for some reason and don't want the reinstalled UF to resend the previous events

Re: No previous events when UF are installed

richgalloway — Mon, 19 Oct 2020 13:32:48 GMT

If you reinstall the UF without uninstalling it then it will not re-index any data.

If you must delete the UF then be sure to preserve the fishbucket directory.

Re: No previous events when UF are installed

jonwick — Mon, 19 Oct 2020 13:49:30 GMT

Thanks for the reply @richgalloway ,

I doubt of Windows server will allow reinstall by not uninstalling the existing one, (reinstalling will clear credentials and confs right?? That is what I want to be specific)

If we preserve fishbucket and paste it again to the newly installed server how reliable it would be ?

Re: No previous events when UF are installed

richgalloway — Mon, 19 Oct 2020 15:27:26 GMT

Windows is quite happy to install new versions of Splunk UF without uninstalling the existing one. I've not tried re-installing the same version.

To clear credentials, just remove the %SPLUNK_HOME%\etc\passwd file and restart the UF with a new user-seed file. To clear configs, just delete the relevant .conf file(s) and restart the UF.

Preserving the fishbucket is very reliable.