Getting Data In

Convert universal forwarder TO lightweight forwarder

adamw
Communicator

For various reasons (performance, not picking up files, etc) we are looking to migrate our syslog receiver from a universal forwarder to a lightweight forwarder.

I have installed the lightweight forwarder package and migrated configurations over, but I want to make sure I grab the checkpoint (place-in-the-file-marker) files, so that no repeat data is indexed. Where can I find these files?

As well, are there any additional considerations before I make the switch, anything else that should be copied over or potential pitfalls?

Thanks,
--adam

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You need to get at minimum the $SPLUNK_HOME/var/lib/splunk/fishbucket directory. That's sufficient for file monitors. I believe if you use Windows Event Log inputs, there is another location you need to snag as well, but I don't know it off the top of my head.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You need to get at minimum the $SPLUNK_HOME/var/lib/splunk/fishbucket directory. That's sufficient for file monitors. I believe if you use Windows Event Log inputs, there is another location you need to snag as well, but I don't know it off the top of my head.

amrit
Splunk Employee
Splunk Employee

$SPLUNK_DB/persistentstorage (also for fschange).

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...