Getting Data In

For a clean installation of a Splunk forwarder, how do we retain a previous forwarder's search history to not reindex what was monitored?

usup_rajbahak
Path Finder

Hey there,

If we were to do a clean install of a Splunk forwarder (rip out previous version of forwarder), is there a way to retain/backup the previous forwarder's search information/history (CRC information??), so that the new forwarder will not re-index all of the log files from the directory the previous forwarder was monitoring?

We do not want to do an in place upgrade of the forwarder, but rip of the old version and install a newer version of the forwarder, without having to re-index all of the log files the old forwarder would have already processed. Or, is this information (the crc) saved in the indexer?

Thanks for your time.
Usup

petercow
Path Finder

Splunk keeps track of what was already indexed in the 'fishbucket' directory, $splunkforwarder$/var/log/splunk/fishbucket

If you upgrade by installing 'on top' of your existing forwarder, its contents will be preserved, so no re-indexing will take place.

0 Karma

usup_rajbahak
Path Finder

thanks petercow..

I understand that doing in place upgrade will retain the settings, but we wanted to do a clean install, and maintain the indexing information where/if possible. Is it then safe to assume that restoring the fishbucket folder would do the trick?

Thanks again

0 Karma

petercow
Path Finder

Not sure, but probably. 🙂

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...