Getting Data In

What is Splunk Universal Forwarder caching functionality?

inters
Explorer

Does anyone know the functionality for the Universal Forwarder and its caching of logs if its disconnected from the indexer. Specifically, what is the functionality of caching a file when it gets rotated to a zipped file while its still disconnected from the indexer?

Do we lose everything that got rotated to a zipped file? Or did everything still get cached, regardless of the log rotation happening or not?

0 Karma

nickhills
Ultra Champion

The UF achieves this, but not by caching.

If a UF is disconnected from the indexers, it simply stops sending data, but it remembers the "place it got to" before it was disconnected.

When the indexer is back online, the UF simply resumes sending from where it left off.

In the case of logs which rotate while the indexer is offline, assuming you monitor stanza does not exclude rolled files, you should still get the full content of the logs, but in these cases, the source name will likely reflect the name of the rolled file mylog.log.1 etc

If my comment helps, please give it a thumbs up!
0 Karma

inters
Explorer

hmmmm, interesting. But assuming we do exclude the rolled files to avoid using unnecessary storage usage, then we would lose the part of the logs that got rolled over?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.