Getting Data In

Why did upgrading my Universal Forwarder result in a license violation?

Path Finder

I am monitoring the directory where IIS logs are stored. The universal forwarder is sending the information on a dedicated index.

To upgrade the universal forwarder, I saved the customization files then I uninstalled the previous version. Then I installed the latest version copying the customization.

As result the universal forwarder re-indexed all files in the logs directory introducing a license violation.

Is it possible to avoid this behaviour saving the previous status of the indexed logs?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You should not have uninstalled the forwarder, you install the new version over the existing forwarder.. When you wiped out the existing forwarder, you cleared the fishbucket which tells Splunk that the data has already been indexed

http://docs.splunk.com/Documentation/Forwarder/6.5.1/Forwarder/Upgradethenixuniversalforwarder

Here's a good blog describing what the fishbucket is and how wiping it out will cause you to reindex the logs
http://blogs.splunk.com/2008/08/14/what-is-this-fishbucket-thing/

View solution in original post

SplunkTrust
SplunkTrust

You should not have uninstalled the forwarder, you install the new version over the existing forwarder.. When you wiped out the existing forwarder, you cleared the fishbucket which tells Splunk that the data has already been indexed

http://docs.splunk.com/Documentation/Forwarder/6.5.1/Forwarder/Upgradethenixuniversalforwarder

Here's a good blog describing what the fishbucket is and how wiping it out will cause you to reindex the logs
http://blogs.splunk.com/2008/08/14/what-is-this-fishbucket-thing/

View solution in original post

Path Finder

I uninstalled the universal forwarder due to a security policy that blocks files modification by a user or program running without admin rights - However, I was not aware about it - thank you for your reply.

0 Karma

SplunkTrust
SplunkTrust

Can you accept the answer and close out the question?

0 Karma

Ultra Champion

Be aware also of the ignoreOlderThan parameter at Edit inputs.conf

-- Causes the monitored input to stop checking files for updates if their modification time (modtime) has passed the threshold