Getting Data In

UFs new pointer after restart

hectorvp
Communicator

If I gracefully shutdown the UF, it will send all logs from output queue and from internal parsing queue.

Suppose I restart the UF after 1min, will it start sending logs from logs file where he had left before shutdown???  

Or will it start sending new logs which are getting appended independent of where had left off.

 

If in such scenarios logs are getting dropped, is there any way to detect how many such logs were dropped? 

What may happen if UF is crashed, obviously it will drop queue logs but from where he would start once he is up and running??

Labels (3)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When the UF starts, it resumes reading log files from where it left off.

If the UF crashes, data read and not sent is lost unless indexer acknowledgment is used.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When the UF starts, it resumes reading log files from where it left off.

If the UF crashes, data read and not sent is lost unless indexer acknowledgment is used.

---
If this reply helps you, Karma would be appreciated.

hectorvp
Communicator

@richgalloway 

Then if UF crashes and we restore it by some means and again UF is up and running ,although UF dropped events which was read but then from where he would start reading new events from the file??

Again would UF start from where he had left off??

0 Karma

richgalloway
SplunkTrust
SplunkTrust
The UF will start from the last file position it saved.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...