Getting Data In

Splunk Universal Forwarder

Path Finder

I wanted to know that, if splunk Universal forwarder service is stopped for some time and then started again. When it starts forwarding the data again, does it forward the data from the time when it was stopped?
More specifically, how many days' data would the universal forwarder forward,once its service is started again,if the service was stopped for a longer duration, say 10 days or so?

Tags (1)
0 Karma


If you stop the UF for a while and restart later it depends on its input configuration and the sources what exactly happens. For example, ten days later the logfile you're monitoring may have been rotated away and potentially even deleted. For rotation you could expand the monitored path to include rotated filenames (usually normal_name.log.1 and so on), but for deletion there's nothing the UF can do. As long as the data is still available in the configured place the UF would go back as far as the time it last ran.

Note, the link provided by linu talks about indexers being down rather than forwarders. No forwarder-based queueing can help you while the forwarder is down.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...