topic Re: Splunk Universal Forwarder in Splunk Search

Is there any way we can control logs generation time?

VijayA — Tue, 11 Apr 2023 17:50:46 GMT

Hi, Can you advise on my Query.

Splunk Universal Forwarder installed on client machine, the are generating log files for every 2hrs, is there any way we can control there logs generation time? can we set anything in UF to generate log files for every 30mins and push to Indexer?

Re: Splunk Universal Forwarder

gcusello — Tue, 11 Apr 2023 09:57:56 GMT

Hi @VijayA,

Splunk reads and immediately sends files when they are generated, the generation frequency hasn't inpact one the UF activity.

If you want to limit the bandwidth occupation of your data, you can setup a limit of the dimension of the data packets sent by the UF, but you don't need any intervene on the frequency.

ciao.

Giuseppe

Re: Splunk Universal Forwarder

VijayA — Tue, 11 Apr 2023 10:10:23 GMT

Hi,

You mean, we can't control the frequency of sending logs from UF to Index, like for every 30mins?

I have no issues with bandwidth occupation, only I want to know is can we set any time frequency to send logs.

Re: Splunk Universal Forwarder

gcusello — Tue, 11 Apr 2023 10:24:29 GMT

Hi @VijayA,

as I said, Splunk continously checks the presence of new logs and reads and sent them.

What's the problem for this behavior?

Ciao.

Giuseppe

Re: Splunk Universal Forwarder

VijayA — Tue, 11 Apr 2023 10:39:06 GMT

Hi,

NO problem from Splunk side, I'm comparing 2 logs from different servers, both are coming to Splunk in different times, not able to extract the correct results. Hence, checking if there any possibility to control.

Thanks for your inputs!