Getting Data In

UF needs to be restarted every time to get data

vikram_m
Path Finder

We have configured our UFs to send data from a particular folder.

But every time the UF need to be stopped and started again after which it starts sending data.

I am also surprised why this is the kind of behavior as it is not feasible idea to restart the services every time whenever we want to get data into Splunk.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

What does /opt/splunkforwarder/var/log/splunk/splunkd.log on the UF say?

0 Karma

micahkemp
Champion

Splunk requires a restart when making changes to inputs (or other index-time configurations) are made. There is some documentation on this, but I didn't see any reference to input changes specifically. I have submitted feedback that it be included.

Edit: this answer assumes you are referencing adding new data to splunk, not just when new files are made available that should already be handled by an existing input.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...