Hello Splunk Community I am currenlty testing Splunk universal forwarder to replace Logstash which use a lot a memory. I installed the latest UF 9.2.0.1 (and tried several other version: 9.1.1, 8.2.9) and everything is working fine, except that my container where splunk uf is running seems to memory leak: Even when I do not add any configuration to splunk uf  the memory of the container is increasing. my docker image uses a FROM image that I use in many other other container without any leak so I have no doubt splunk uf is at fault here So I wonder if anyone using splunk uf is experiencing the same issue ? or if there is an ongoing ticket tracking this memory leak? The memory leak is not huge but my container is supposed to run 24/7 so I cannot afford any leak. Thanks for your feedback. ... View more

Hello Splunk community, I would like to know if there is a way to change the database location of monitored file in slunk universal forwarder, similarly to what fluentbit allow with the DB property (https://docs.fluentbit.io/manual/pipeline/inputs/tail). My splunk universal forwarder is running in a container and access a shared mount containing my applications log files and in case the the splunk uf container restart I would like to prevent the monitored files to be reindexed from the beginning. Is there a config to choose the database location? Cheers in advance ... View more