No previous events when UF are installed

[jonwick]

Hi Splunkers,

When UFs are installed, I don't want them to send all the events which were generated prior to UF was installed.

I just want UF to start sending logs when it was installed.

Is there a way to conf this?

To be honest we need to reinstall UFs for some reason and don't want the reinstalled UF to resend the previous events

[richgalloway]

Windows is quite happy to install new versions of Splunk UF without uninstalling the existing one.  I've not tried re-installing the same version.

To clear credentials, just remove the %SPLUNK_HOME%\etc\passwd file and restart the UF with a new user-seed file.  To clear configs, just delete the relevant .conf file(s) and restart the UF.

Preserving the fishbucket is very reliable.

[richgalloway · Accepted solution]

If you reinstall the UF without uninstalling it then it will not re-index any data.

If you must delete the UF then be sure to preserve the fishbucket directory.

[jonwick]

Thanks for the reply @richgalloway ,

I doubt of Windows server will allow reinstall by not uninstalling the existing one, (reinstalling will clear credentials and confs right?? That is what I want to be specific)

If we preserve fishbucket and paste it again to the newly installed server how reliable it would be ?