
Known issues
This topic lists known issues that are specific to the universal forwarder. For information on fixed issues, see Fixed issues.
Universal forwarder issues
Date filed | Issue number | Description |
---|---|---|
2020-09-29 | SPL-195635, SPL-202178, SPL-206477, SPL-202163, SPL-206534 | Splunkd increased memory usage over time when monitoring UDP port(s) with in inputs.conf |
2020-03-27 | SPL-185540, SPL-183953 | Batch Stanza deleting file upon restart/read completion |
2019-05-28 | SPL-171178, SPL-167307, SPL-202078 | Indexer Acknowledgement causes metric index events that do not have "_raw" fields to be duplicated Workaround: Indexer acknowledgement is a feature that helps prevent loss of data when forwarders send data to an indexer. Indexer acknowledgement is controlled by the Boolean useACK setting in inputs.conf and outputs.conf .
Indexer acknowledgement uses the When this issue occurs, the workaround is to set |
2019-01-28 | SPL-165635, SPL-191773, SPL-189789 | splunk not reading file after log rotation |
2018-04-10 | SPL-153251 | Universal Forwarder txz package cannot be installed on FreeBSD 11.1 Workaround: 1. Use pkg install instead of pkg add OR
2. Install package by untarring tgz file to /opt/splunkforwarder |
2015-04-14 | SPL-99687, SPL-129637 | Splunk universal forwarder is 7-10 days behind recent Windows Security and system log events. Workaround: To mitigate this, edit the following stanza in inputs.conf: [WinEventLog://Security] evt_resolve_ad_obj = 0. |
2015-04-07 | SPL-99316 | Universal Forwarders stop sending data repeatedly throughout the day Workaround: In limits.conf, try changing file_tracking_db_threshold_mb in the [inputproc] stanza to a lower value. |
2014-08-05 | SPL-88396 | After configuring a client name for a deployment client, the name is not shown in the Forwarder Management UI Workaround: Create a server class, where you can see the client name, and use that group when you add data. |
PREVIOUS Troubleshoot the universal forwarder with Splunk Enterprise |
NEXT Fixed issues |
This documentation applies to the following versions of Splunk® Universal Forwarder: 8.0.1, 8.0.2, 8.0.3
Feedback submitted, thanks!