We have configured our UFs to send data from a particular folder.
But every time the UF need to be stopped and started again after which it starts sending data.
I am also surprised why this is the kind of behavior as it is not feasible idea to restart the services every time whenever we want to get data into Splunk.
What does /opt/splunkforwarder/var/log/splunk/splunkd.log
on the UF say?
Splunk requires a restart when making changes to inputs (or other index-time configurations) are made. There is some documentation on this, but I didn't see any reference to input changes specifically. I have submitted feedback that it be included.
Edit: this answer assumes you are referencing adding new data to splunk, not just when new files are made available that should already be handled by an existing input.