Deployment Architecture

Which location/path is stored the splunk data using universal forwarder?

05500
New Member

If we forward data using universal forwarder from each servers to splunk server,

Q1, Which location/path is stored the forwarded data (original event log data / not indexed data)?
Q2, Which location/path is stored the indexed data?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

For your questions..

On the UF, data is stored in $splunk_home$/var/run/* until its forwarded to the indexer layer.

On the Indexer, this is typically stored in $splunk_home$/var/lib/splunk/. However, that is configurable and can be placed anywhere on the file system that you choose.

05500
New Member

Once the forwarded data is moved/indexed from $splunk_home$/var/run/* to $splunk_home$/var/lib/splunk/,
This move is automatically?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Forwarders forward data to indexers. If you're running an all in one instance, then there is no UF involved. You are ingested the data and its being written to the indexes in $splunk_home$/var/lib/splunk/*.

For UFs, they delete the queued data after it is forwarded.

0 Karma

05500
New Member

On the UF, data is stored in $splunk_home$/var/run/* until its forwarded to the indexer layer.

-> If it forwarded to the indexer layer, does data delete on $splunk_home$/var/run/* ?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Once a forwarder ingests and forwards the data, nothing is stored locallly on the UF in Splunk.

If you are ingesting syslog or other files, those will still be on the filesystem, but thats outside of Splunk.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>