How to get lost data into UF from the last disabled/turned off time automatically

[chandana204]

Hi, I have new scenario.

I installed Universal Forwarder in a server where i get other server_logs in a folder. Whenever I turned off my server, the UF is also getting turned off. After restarting my server, the Universal forwarder is running perfectly and getting data from the server from the turned on time. When server turned on it's getting off-time data in the server automatically. I want to get the off-time data into Universal Forwarder automatically from the server.

I have one thought that, whenever I turned on UF, it should crosscheck the last disable time then the UF automatically get data from the disable time. Is it possible to set in UF configurations?

[somesoni2]

If the server logs are getting rolled off and you're not monitoring the rolled logs, there is no way for Splunk to read those rolled logs automatically. What all monitoring you do on your UF? Do you monitor rolled logs? Do you crcSalt attribute in your inputs.conf?

[chandana204]

I am monitoring live log for real-time ingestion. yes, i have mentioned crcSalt attribute in inputs.conf

[sudosplunk]

Hello,
Basic functionality of splunk is to check CRCs and start ingesting the file from where it left off.

Does the file modification time change when off-time data is written?
Is off-time data written to the same file?
Does the file name change after off-time data is written?
Also, what is the value of crcSalt?