Getting Data In

Universal Forwarder resending event log data

splunkjas1
Explorer

If the IP address for a host changes or if it gets a new GUID, would the forwarder resend the entire Windows event log?

0 Karma
1 Solution

nickhills
Ultra Champion

It depends.
If you uninstalled the old forwarder and then reinstalled the new one, it’s quite possible that it will re-read and send all the logs.

If you upgraded the forwarder this should not occurr, even if the ip or guild changes.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

It depends.
If you uninstalled the old forwarder and then reinstalled the new one, it’s quite possible that it will re-read and send all the logs.

If you upgraded the forwarder this should not occurr, even if the ip or guild changes.

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

I noted “possible” because depending on your config, it may elect to only send evens which are older than x days, or in the case of windows events, only while the forwarder is running. Neither of these are default config, and have drawbacks.

If my comment helps, please give it a thumbs up!
0 Karma

somesoni2
Revered Legend

Is your forwarder resending event logs again? Has any specific activity was performed on your UF like version upgrade?

0 Karma

splunkjas1
Explorer

The forwarders are resending event logs. We upgraded them from 6.4.4 to 6.4.9. Would the upgrade cause logs to be resent?

0 Karma

somesoni2
Revered Legend

It should'nt. How did you do the upgrade (procedure)? Was it it inline with what this Splunk documentation suggests?
https://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/UpgradetheWindowsuniversalforwarder#...

0 Karma

splunkjas1
Explorer

I asked the folks who performed the upgrade and they told me they do uninstall the 6.4.4 version before installing 6.4.9. So that's probably what caused the logs to be resent, would you agree?

0 Karma

nickhills
Ultra Champion

Yes. In that case I would say it’s expected behaviour

If my comment helps, please give it a thumbs up!
0 Karma

splunkjas1
Explorer

Okay, thank you.

0 Karma

nickhills
Ultra Champion

I converted my comment to an answer, so you can accept it if it helped

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...