Hello,
I've got a data input where zipped evtx files are placed for ingestion on a server with the UF installed on it. The local inputs.conf file is modified to point to the folder with the files. The zipped files are unzipped to the Program FIles\var\run\splunk\upload folder where they will stay until ingested.
The problem starts when I interrupt the Splunk instance, either by restarting the server or restarting the instance manually using the cmd prompt i.e splunk restart. After restarting the service, the files don't seem to resume ingestion anymore.
How do I make sure that the UF resumes where it left off? Thanks.
