Getting Data In

How to get lost data into UF from the last disabled/turned off time automatically


Hi, I have new scenario.

I installed Universal Forwarder in a server where i get other server_logs in a folder. Whenever I turned off my server, the UF is also getting turned off. After restarting my server, the Universal forwarder is running perfectly and getting data from the server from the turned on time. When server turned on it's getting off-time data in the server automatically. I want to get the off-time data into Universal Forwarder automatically from the server.

I have one thought that, whenever I turned on UF, it should crosscheck the last disable time then the UF automatically get data from the disable time. Is it possible to set in UF configurations?

0 Karma

Revered Legend

If the server logs are getting rolled off and you're not monitoring the rolled logs, there is no way for Splunk to read those rolled logs automatically. What all monitoring you do on your UF? Do you monitor rolled logs? Do you crcSalt attribute in your inputs.conf?

0 Karma


I am monitoring live log for real-time ingestion. yes, i have mentioned crcSalt attribute in inputs.conf

0 Karma


Basic functionality of splunk is to check CRCs and start ingesting the file from where it left off.

Does the file modification time change when off-time data is written?
Is off-time data written to the same file?
Does the file name change after off-time data is written?
Also, what is the value of crcSalt?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...