Deployment Architecture

Can I configure a Splunk Forwarder to forward all log data before shutting down?

New Member

If I am about to shutdown my system, how can I make sure that the Splunk Forwarder has forwarded all log data off of the instance? In this case, the logs will be deleted when the system shuts down, so I want to make sure no log data goes missing.

0 Karma

Splunk Employee
Splunk Employee

You can't tell splunk to prevent a system from shutting down. However, you can run something like

tail -100 /opt/splunkforwarder/var/log/splunk/metrics.log | grep queue | grep tcpout

and make sure "current_size" = 0 before shutting it down.

0 Karma


What you mean by "my System",Is it a UF or Indexer?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...