Getting Data In

Splunk Universal Forwarder

Path Finder

I wanted to know that, if splunk Universal forwarder service is stopped for some time and then started again. When it starts forwarding the data again, does it forward the data from the time when it was stopped?
More specifically, how many days' data would the universal forwarder forward,once its service is started again,if the service was stopped for a longer duration, say 10 days or so?

Tags (1)
0 Karma


If you stop the UF for a while and restart later it depends on its input configuration and the sources what exactly happens. For example, ten days later the logfile you're monitoring may have been rotated away and potentially even deleted. For rotation you could expand the monitored path to include rotated filenames (usually normal_name.log.1 and so on), but for deletion there's nothing the UF can do. As long as the data is still available in the configured place the UF would go back as far as the time it last ran.

Note, the link provided by linu talks about indexers being down rather than forwarders. No forwarder-based queueing can help you while the forwarder is down.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...