Deployment Architecture

Data Ingestion Only Works After Restart of Splunk


I am using a script to poll cloud API for data at frequent intervals. The data is stored in archived *.csv.gz files and a UF installed on the same server is configured to monitor the folder:

sourcetype = data:1
index = data_1
_TCP_ROUTING = primary_indexers_site_1

The problem is that data only get ingested after a restart of the UF Splunk service on the host, and then almost immediately stops. Meaning I have to restart the UF every time I want to get new/current data.

The script does not appear to be the issue because it is constantly pulling new data into the folder as expected.

Anyone seen this before?

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...