Relation between fishbuckets and check point files.

[sunrise]

Hi Splunkers,

I know that Universal Forwarder monitoring windows eventlog has a check point file and fishbuckets.
In re-transferring data to the Indexer, we have two cases.

For example, it seems to be two cases.
1. Delete fishbuckets, not changing check points files.
2. Change check point files, not deleting fishbuckets.

Case 1, in default setting, UF seems to transfer all local eventlog to Indexer.

Case 2, we actually can set a record ID from which start to read.

But I cannot understand these logic.
Does UF read check point file and start transferring data irrelevant to fishbuckets ?
Or does UF not transfer data in spite of changing the check point file because of fishbuckets ?

Thak you for your help.

[gkanapathy · Accepted solution]

Checkpoint files are used to track position in the windows event logs. The fish bucket is used to track position in files (read by the monitor:// input processor). A particular input type uses either one or the other.