Getting Data In

How to get lost data into UF from the last disabled/turned off time automatically

chandana204
Communicator

Hi, I have new scenario.

I installed Universal Forwarder in a server where i get other server_logs in a folder. Whenever I turned off my server, the UF is also getting turned off. After restarting my server, the Universal forwarder is running perfectly and getting data from the server from the turned on time. When server turned on it's getting off-time data in the server automatically. I want to get the off-time data into Universal Forwarder automatically from the server.

I have one thought that, whenever I turned on UF, it should crosscheck the last disable time then the UF automatically get data from the disable time. Is it possible to set in UF configurations?

0 Karma

somesoni2
Revered Legend

If the server logs are getting rolled off and you're not monitoring the rolled logs, there is no way for Splunk to read those rolled logs automatically. What all monitoring you do on your UF? Do you monitor rolled logs? Do you crcSalt attribute in your inputs.conf?

0 Karma

chandana204
Communicator

I am monitoring live log for real-time ingestion. yes, i have mentioned crcSalt attribute in inputs.conf

0 Karma

sudosplunk
Motivator

Hello,
Basic functionality of splunk is to check CRCs and start ingesting the file from where it left off.

Does the file modification time change when off-time data is written?
Is off-time data written to the same file?
Does the file name change after off-time data is written?
Also, what is the value of crcSalt?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...