UF needs to be restarted every time to get data

[vikram_m]

We have configured our UFs to send data from a particular folder.

But every time the UF need to be stopped and started again after which it starts sending data.

I am also surprised why this is the kind of behavior as it is not feasible idea to restart the services every time whenever we want to get data into Splunk.

[skoelpin]

What does /opt/splunkforwarder/var/log/splunk/splunkd.log on the UF say?

[micahkemp]

Splunk requires a restart when making changes to inputs (or other index-time configurations) are made. There is some documentation on this, but I didn't see any reference to input changes specifically. I have submitted feedback that it be included.

Edit: this answer assumes you are referencing adding new data to splunk, not just when new files are made available that should already be handled by an existing input.