https://community.splunk.com/t5/Getting-Data-In/Restarting-SplunkForwarder-Service/m-p/442663#M95271 <P>It should pickup from where it Left , IF<BR /> - <CODE>current_only</CODE> is NOT specified<BR /> - <CODE>start_from</CODE> is inclusive and before your stoppage time<BR /> - and EventLogs were not purged when you stopped/started</P> <P>In Essence, if you have stopped for prolonged time and started it afterwards, it may lead of loss of data<BR /> inputs.conf docs is quite extensive if you need <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/MonitorWindowseventlogdata">further options</A></P> Wed, 08 May 2019 14:43:31 GMT koshyk 2019-05-08T14:43:31Z https://community.splunk.com/t5/Getting-Data-In/Restarting-SplunkForwarder-Service/m-p/442662#M95270 <P>To preface i'm talking about a Windows Server with Universal Forwarder installed on it.</P> <P>If i restart the SplunkForwarder Service on an active server that is generating logs, will the forwarder pick up from where it was right before the restart, or will there be a gap in time of missing events indexed?</P> Wed, 08 May 2019 13:36:56 GMT https://community.splunk.com/t5/Getting-Data-In/Restarting-SplunkForwarder-Service/m-p/442662#M95270 dcostamps 2019-05-08T13:36:56Z https://community.splunk.com/t5/Getting-Data-In/Restarting-SplunkForwarder-Service/m-p/442663#M95271 <P>It should pickup from where it Left , IF<BR /> - <CODE>current_only</CODE> is NOT specified<BR /> - <CODE>start_from</CODE> is inclusive and before your stoppage time<BR /> - and EventLogs were not purged when you stopped/started</P> <P>In Essence, if you have stopped for prolonged time and started it afterwards, it may lead of loss of data<BR /> inputs.conf docs is quite extensive if you need <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/MonitorWindowseventlogdata">further options</A></P> Wed, 08 May 2019 14:43:31 GMT https://community.splunk.com/t5/Getting-Data-In/Restarting-SplunkForwarder-Service/m-p/442663#M95271 koshyk 2019-05-08T14:43:31Z