Getting Data In

Re-send data with universal forwarder?

kevintelford
Path Finder

When using a lightweight-forwarder we were able to clean the fishbucket (eventdata) so that we could re-forward data. Trying this on the new universal forwarder yields the message "ERROR: Cleaning eventdata is not supported on this version." Is there a new way to do this?

Thanks, Kevin

Tags (1)
1 Solution

amrit
Splunk Employee
Splunk Employee

There is currently no command that will clean only the fishbucket (this is a bug, lack of foresight, something). You should file an ER for this, but in the meantime you can just wipe the contents of $SPLUNK_DB/var/lib/splunk/fishbucket/ .

View solution in original post

cervelli
Splunk Employee
Splunk Employee

The clean all command works for removing the fishbucket on a UF. Is there a reason you can't issue that command?

gkanapathy
Splunk Employee
Splunk Employee

cervelli said clean all. not clean eventdata.

0 Karma

ferenc0521
New Member

clean all removed all user data, including admin. I cannot add admin back, because it requires authorization.
catch 22

0 Karma

ferenc0521
New Member

so tried clean all, but didn't see the files/events resent, moreover the admin user is gone, so
can't check with:
https://:8089/services/admin/inputstatus/TailingProcessor:FileStatus
because no auth with admin is possible.

I guess reinstall/config is next step

0 Karma

tonopahtaos
Path Finder

Here is why:

C:\Program Files\SplunkUniversalForwarder\bin>splunk clean eventdata
This action will permanently erase all events from ALL indexes; it cannot be und
one.
Are you sure you want to continue [y/n]? y
ERROR: Cleaning eventdata is not supported on this version.

gkanapathy
Splunk Employee
Splunk Employee

I don't know his problem, but I guess this would wipe/reset the user/password data, wouldn't it?

amrit
Splunk Employee
Splunk Employee

There is currently no command that will clean only the fishbucket (this is a bug, lack of foresight, something). You should file an ER for this, but in the meantime you can just wipe the contents of $SPLUNK_DB/var/lib/splunk/fishbucket/ .

tonopahtaos
Path Finder

This did not work for me. When UF was running, i got a error when I wiped out the content of 'fishbucket'. I have to stop UF first, then remove all under 'fishbucket'. After restarting UF, i did not see any admon or Windows audit event resent.

0 Karma

amrit
Splunk Employee
Splunk Employee

You want a cookie?

kevin_telford
New Member

Four plus years and still no cookie. Hopefully you don't treat all the ladies this way.

0 Karma

kevintelford
Path Finder

Submitted: Case # 57213

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...