Getting Data In

How to avoid forwarding the event which has already forwarded after restart of forwarder

New Member

Today I have change configuration of forwarder and restarted it, after restart it is forwarding previous events as well which forwarder has already forwarder.

How I can make sure that after restart, forwarder will only send latest data not previous one.

0 Karma


Hi moohkhol,

the default behavior of an universal forwarder is, to continue where it left ..... unless you did set crcsalt = <SOURCE> for example. This can lead to re-indexing.

You could use the ignoreOlderThan option in inputs.conf to ignore files that are older then your set value.

Also, re-indexing will take place if the universal forwarders fishbucket got cleaned by exectuing splunk clean all or by removing files form $SPLUNK_HOME/var/lib/splunk/fishbucket.

cheers, MuS

0 Karma

New Member

I have not set crcsalt in inputs.conf but still i am seeing that, forwarder is sending older data. I have controlled it with ignoreOlderThan =1d but this will still send duplicate data of 1 day. I am using heavy forwarder .. any though on this ??

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...