splunk add oneshot behavior

[dshakespeare_sp]

We have loaded a 16GB file using oneshot from the command line of a universal forwarder. When the UF was restarted, the data load stopped and did not resume after restart. Is this the behavior of oneshot? Does oneshot not use the fishbucket or stash?

[dshakespeare_sp]

This is the correct behaviour of oneshot. It is designed as a "onetime" input. We read the source from start of file and stop when we reach EOF. We do not expect check the file again for growth, so there is no need to use fishbucket or stash

[aholzer]

Given that you answered your own question it would have been nice if you added the link to the documentation where you found the answer. Good job on finding the answer though.

[Glenn]

It doesn't answer the question fully. If the file was still being loaded when the instance was restarted (ie. it was huge and took a long time), the indexing will not proceed through the rest of the file and you will get a partial upload.