Getting Data In

Do I need to back up the UF fishbucket?

rxdeleon
Explorer

I would just like to know if it is necessary to back up the UF fishbucket. Is there any reason I would need to restore it other than not indexing log data more than once?

Tags (1)
0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

The short answer is no.
The fishbucket exists to keep track of which files have been read by the forwarder, you can stop the forwarder delete it & it will be re-created when the forwarder starts up again. Of course if it is deleted the forwarder will re-read all the monitored files and likely duplicate data within your system...

If you do correctly restore the fishbucket (assuming it did not have in flight changes occurring!) then that would prevent the data duplication problem...

View solution in original post

0 Karma

gjanders
SplunkTrust
SplunkTrust

The short answer is no.
The fishbucket exists to keep track of which files have been read by the forwarder, you can stop the forwarder delete it & it will be re-created when the forwarder starts up again. Of course if it is deleted the forwarder will re-read all the monitored files and likely duplicate data within your system...

If you do correctly restore the fishbucket (assuming it did not have in flight changes occurring!) then that would prevent the data duplication problem...

0 Karma

rxdeleon
Explorer

Thanks @garethatiag

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...