Does the Universal forwarder index events?

[tim9gray]

Does the universal forwarder index events like splunk does? Here is the scenario I a curious about - if I am using Splunk with a universal forwarder(s) and I want to do a clean all to dump all my event data(this is just while I am playing around testing queries and stuff) from Splunk, will the Universal forwarder recognize this and resend the events that Splunk is now missing?

Do I have to do something similar with the Universal forwarder? If the forwarder is running on windows and as a service, how would I do this if necessary? - Would I stop the service and then run it manually with the appropriate command line arguments?

[rturk · Accepted solution]

Hi Tim,

The Universal Forwarder does not index data, only collecting and forwarding it to an upstream indexer.

What the forwarder does do is keep track of log file events it has sent as part of the internal _fishbucket index. This keeps track of where in a log file Splunk is up to for the purposes of forwarding only new events. If you want to tell the Forwarder to send all events again, you can clean out the _fishbucket using the following command:

splunk clean eventdata _thefishbucket

Just keep in mind, this will result in duplicate data upstream if it's already been indexed.

Hope this helps 🙂

[ChrisG]

Just as a reference, there is a docs topic that discusses the different types of forwarders: http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Typesofforwarders