Getting Data In

Splunk UF Backlog

johann2017
Explorer

Hey everyone, quick UF question here... If a UF stops for whatever reason then comes back on later on, will the UF send the backlogs it missed while the service went offline?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @johann2017,
yes: if connection with Indexer is interrupted, UF locally caches logs and send them as soon as connection is restored.

If it's the UF itself to stop, when it restarts it ingest all the logs from the last ingested.

There's only one situation when logs are lost and it's when I use an Heavy Forwarder to ingest syslogs but it's out of scope of your question.

Ciao.
Giuseppe

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, UFs will pick up where they left off.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

johann2017
Explorer

Thank you rich!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @johann2017,
yes: if connection with Indexer is interrupted, UF locally caches logs and send them as soon as connection is restored.

If it's the UF itself to stop, when it restarts it ingest all the logs from the last ingested.

There's only one situation when logs are lost and it's when I use an Heavy Forwarder to ingest syslogs but it's out of scope of your question.

Ciao.
Giuseppe

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!