Why Splunk log management doesn't update log data or synchronize if server is shutdown and restart?

[praveen89]

Hi Team,

I have installed Splunk log management on my windows system 8.1. It' really good software but there is one bug in software that if desktop or servers shutdown & restart then Splunk log management software doesn't update the log data or synchronize.

Can you please suggest to me how to resolve this issue or need any configuration in Splunk log management software so log database can be update or synchronize without any trouble.

Looking forward your quick reply. Any help would be more appreciated.

Thanks
Praveen Kumar
Email : [email protected]

[jrodman]

Splunk handles shutdowns and restarts of servers and Splunk itself. It handles continuing from where it left off. Therefore this is really a troubleshooting scenario but we don't have much information to go on.

[alacercogitatus]

Please define "Log Database". You probably want to look at the documentation on how to install indexers, search heads, and forwarders.

http://docs.splunk.com/Documentation/Splunk/6.1.3/Overview/Administering

[linu1988]

which log management software? if we are talking about event logs it will start from where it left off.