change location of Database containing seekAddress and seekCRC for monitored files

[Superjo007]

Hello Splunk community,

I would like to know if there is a way to change the database location of monitored file in slunk universal forwarder, similarly to what fluentbit allow with the DB property (https://docs.fluentbit.io/manual/pipeline/inputs/tail).

My splunk universal forwarder is running in a container and access a shared mount containing my applications log files and in case the the splunk uf container restart I would like to prevent the monitored files to be reindexed from the beginning.

Is there a config to choose the database location?

Cheers in advance

[richgalloway]

Splunk stores that information in the "fishbucket" at /opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db.  That database cannot be changed or moved, but you should be able to backup and restore it.