Getting Data In
Highlighted

How to get lost data into UF from the last disabled/turned off time automatically

Path Finder

Hi, I have new scenario.

I installed Universal Forwarder in a server where i get other server_logs in a folder. Whenever I turned off my server, the UF is also getting turned off. After restarting my server, the Universal forwarder is running perfectly and getting data from the server from the turned on time. When server turned on it's getting off-time data in the server automatically. I want to get the off-time data into Universal Forwarder automatically from the server.

I have one thought that, whenever I turned on UF, it should crosscheck the last disable time then the UF automatically get data from the disable time. Is it possible to set in UF configurations?

0 Karma
Highlighted

Re: How to get lost data into UF from the last disabled/turned off time automatically

SplunkTrust
SplunkTrust

If the server logs are getting rolled off and you're not monitoring the rolled logs, there is no way for Splunk to read those rolled logs automatically. What all monitoring you do on your UF? Do you monitor rolled logs? Do you crcSalt attribute in your inputs.conf?

0 Karma
Highlighted

Re: How to get lost data into UF from the last disabled/turned off time automatically

Path Finder

I am monitoring live log for real-time ingestion. yes, i have mentioned crcSalt attribute in inputs.conf

0 Karma
Highlighted

Re: How to get lost data into UF from the last disabled/turned off time automatically

Motivator

Hello,
Basic functionality of splunk is to check CRCs and start ingesting the file from where it left off.

Does the file modification time change when off-time data is written?
Is off-time data written to the same file?
Does the file name change after off-time data is written?
Also, what is the value of crcSalt?

0 Karma