Getting Data In

How to configure a Windows Splunk forwarder to pick up where it left off if the forwarder server stops and events are not forwarded?

adamblock2
Path Finder

I am in the process of adding the following to an inputs.conf file with the intent of forwarding events from a Windows Event Forwarding Server:

[WinEventLog://ForwardedEvents]
sourcetype=WinEventLog:ForwardedEvents
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = wineventlog
renderXml=false

This has prompted a question, though. It is my understanding that the "current_only" value can be used to tell Splunk to either start reading events from the beginning, or only the most current (as in tail -f). If the forwarder service stops for some reason, and events are not forwarded, is there a way to instruct the forwarder to "pick up where it left off" so to speak? Is the forwarder capable of remembering the last event which was forwarded so to start at that point as opposed to either at the beginning or end?

Thank you.

0 Karma
1 Solution

lguinn2
Legend

Default behavior
The Splunk forwarder always remembers where it left off and restarts from that point for file-based inputs. Each time the forwarder examines a file, it starts from its current file pointer within the file; this file pointer is preserved in the Splunk internal index called the "fishbucket." Stopping or restarting the forwarder will not cause any events to be skipped.

current_only=0 tells Splunk to read all events. This aligns with the default behavior above. current_only=0 is the default setting.

current_only=1 overrides the default behavior. It specifies that Splunk should start collecting the data from the current point in time and ignore older data in the event log. If you stop or restart the Splunk forwarder with this setting, Splunk will probably skip events.

I would not use current_only=1.

View solution in original post

0 Karma

lguinn2
Legend

Default behavior
The Splunk forwarder always remembers where it left off and restarts from that point for file-based inputs. Each time the forwarder examines a file, it starts from its current file pointer within the file; this file pointer is preserved in the Splunk internal index called the "fishbucket." Stopping or restarting the forwarder will not cause any events to be skipped.

current_only=0 tells Splunk to read all events. This aligns with the default behavior above. current_only=0 is the default setting.

current_only=1 overrides the default behavior. It specifies that Splunk should start collecting the data from the current point in time and ignore older data in the event log. If you stop or restart the Splunk forwarder with this setting, Splunk will probably skip events.

I would not use current_only=1.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...