Getting Data In

How to get lost data into UF from the last disabled/turned off time automatically


Hi, I have new scenario.

I installed Universal Forwarder in a server where i get other server_logs in a folder. Whenever I turned off my server, the UF is also getting turned off. After restarting my server, the Universal forwarder is running perfectly and getting data from the server from the turned on time. When server turned on it's getting off-time data in the server automatically. I want to get the off-time data into Universal Forwarder automatically from the server.

I have one thought that, whenever I turned on UF, it should crosscheck the last disable time then the UF automatically get data from the disable time. Is it possible to set in UF configurations?

0 Karma

Revered Legend

If the server logs are getting rolled off and you're not monitoring the rolled logs, there is no way for Splunk to read those rolled logs automatically. What all monitoring you do on your UF? Do you monitor rolled logs? Do you crcSalt attribute in your inputs.conf?

0 Karma


I am monitoring live log for real-time ingestion. yes, i have mentioned crcSalt attribute in inputs.conf

0 Karma


Basic functionality of splunk is to check CRCs and start ingesting the file from where it left off.

Does the file modification time change when off-time data is written?
Is off-time data written to the same file?
Does the file name change after off-time data is written?
Also, what is the value of crcSalt?

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...