Hello,
we have an issue with persistent queue not working correctly. As visible below we have enabled persistent Queue with size 100MB for windows security logs. Unfortunately even though we have disabled the access to indexers from the UF the queue is still not being created in c:\programfiles\splunkuniversalforwarder/var/run/splunk/, even though i has been running for 24h. Can you point me what I'm doing wrong?
C:\Program Files\SplunkUniversalForwarder\etc\apps\somethingels_TA_DS_DC_activedirectory_log_collection\local\inputs.conf [WinEventLog://Security]
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf blacklist1 = something
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf blacklist2 = something
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf checkpointInterval = 5
C:\Program Files\SplunkUniversalForwarder\etc\apps\somethingels_TA_DS_DC_activedirectory_log_collection\local\inputs.conf current_only = 0
C:\Program Files\SplunkUniversalForwarder\etc\apps\somethingels_TA_DS_DC_activedirectory_log_collection\local\inputs.conf disabled = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_resolve_ad_obj = 1
host = something
C:\Program Files\SplunkUniversalForwarder\etc\apps\somethingels_TA_DS_DC_activedirectory_log_collection\local\inputs.conf index = <<indexname>>
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\apps\win-pers-test\local\inputs.conf persistentQueueSize = 100MB
C:\Program Files\SplunkUniversalForwarder\etc\apps\somethingels_TA_DS_DC_activedirectory_log_collection\local\inputs.conf renderXml = false
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf start_from = oldest
C:\Program Files\SplunkUniversalForwarder\etc\apps\somethingels_TA_DS_DC_activedirectory_log_collection\local\inputs.conf whitelist =
