Getting Data In

Do I need to back up the UF fishbucket?

rxdeleon
Explorer

I would just like to know if it is necessary to back up the UF fishbucket. Is there any reason I would need to restore it other than not indexing log data more than once?

Tags (1)
0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

The short answer is no.
The fishbucket exists to keep track of which files have been read by the forwarder, you can stop the forwarder delete it & it will be re-created when the forwarder starts up again. Of course if it is deleted the forwarder will re-read all the monitored files and likely duplicate data within your system...

If you do correctly restore the fishbucket (assuming it did not have in flight changes occurring!) then that would prevent the data duplication problem...

View solution in original post

0 Karma

gjanders
SplunkTrust
SplunkTrust

The short answer is no.
The fishbucket exists to keep track of which files have been read by the forwarder, you can stop the forwarder delete it & it will be re-created when the forwarder starts up again. Of course if it is deleted the forwarder will re-read all the monitored files and likely duplicate data within your system...

If you do correctly restore the fishbucket (assuming it did not have in flight changes occurring!) then that would prevent the data duplication problem...

0 Karma

rxdeleon
Explorer

Thanks @garethatiag

0 Karma
Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...