Getting Data In

Do I need to back up the UF fishbucket?

rxdeleon
Explorer

I would just like to know if it is necessary to back up the UF fishbucket. Is there any reason I would need to restore it other than not indexing log data more than once?

Tags (1)
0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

The short answer is no.
The fishbucket exists to keep track of which files have been read by the forwarder, you can stop the forwarder delete it & it will be re-created when the forwarder starts up again. Of course if it is deleted the forwarder will re-read all the monitored files and likely duplicate data within your system...

If you do correctly restore the fishbucket (assuming it did not have in flight changes occurring!) then that would prevent the data duplication problem...

View solution in original post

0 Karma

gjanders
SplunkTrust
SplunkTrust

The short answer is no.
The fishbucket exists to keep track of which files have been read by the forwarder, you can stop the forwarder delete it & it will be re-created when the forwarder starts up again. Of course if it is deleted the forwarder will re-read all the monitored files and likely duplicate data within your system...

If you do correctly restore the fishbucket (assuming it did not have in flight changes occurring!) then that would prevent the data duplication problem...

0 Karma

rxdeleon
Explorer

Thanks @garethatiag

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...