Getting Data In

Behaviour of containerized universal forwarder on restart

zapping575
Communicator

Dear all,

despite my best efforts, I was not able to find satisfactory information. Thus I would like to ask if anyone here can help me with this.

We have the UF running in a docker container in a k8s environment. For getting data in, we are using batch/monitor on files stored on a persistant volume claim.

Consider the following scenario:

- The container the UF is running in gets restarted while the UF is processing a file. After booting back up, the UF re-processes the entire file, leading to duplicates on the indexer

Is this something we need to consider, for example by checking that the UF is currently not processing anything before restarting? Or will the UF take care of all of this for us?

Labels (3)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...