Splunk Universal Forwarder

[garima_chauhan]

Hi,
I wanted to know that, if splunk Universal forwarder service is stopped for some time and then started again. When it starts forwarding the data again, does it forward the data from the time when it was stopped?
More specifically, how many days' data would the universal forwarder forward,once its service is started again,if the service was stopped for a longer duration, say 10 days or so?

[martin_mueller]

If you stop the UF for a while and restart later it depends on its input configuration and the sources what exactly happens. For example, ten days later the logfile you're monitoring may have been rotated away and potentially even deleted. For rotation you could expand the monitored path to include rotated filenames (usually normal_name.log.1 and so on), but for deletion there's nothing the UF can do. As long as the data is still available in the configured place the UF would go back as far as the time it last ran.

Note, the link provided by linu talks about indexers being down rather than forwarders. No forwarder-based queueing can help you while the forwarder is down.