If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?
If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?
The fishbucket is a special index in Splunk that keeps track of indexed files and their current read positions. When an update is made to an attribute in inputs.conf on a universal forwarder, the fishbucket checkpoint must be reset on the forwarder itself in order to reindex the data. This is because the forwarder is responsible for sending data to the indexer, and it uses the fishbucket to track which data has already been sent. Resetting the fishbucket on the forwarder ensures that data is re-read and sent to the indexer again.
Isn't it B? The files checkpoints reside in the UF's fishbucket index, right? So we should reset in the UF
Agreed B. Quoting the Splunk Reference URL https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket-thing.html "Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf"
Answer: B -change the inputs.conf on the deployment server (or forwarders) -reset the fishbucket checkpoint on the involved forwarders
The correct ANS is B.
Answer: B Data Admin Slide 132: To re-index step 3: Reset the fishbucket checkpoint on the involved forwarders.
https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket-thing.html Answer is B
A is Correct, universal forwarders don't index data. Indexing always on indexers.
Option A is incorrect because resetting the fishbucket on the indexer would not have any effect on the universal forwarder. Option C is incorrect because resetting the fishbucket on the search head is not necessary in this scenario. Option D is incorrect because the deployment server is used to manage and distribute configurations to forwarders, but resetting the fishbucket would need to be done on the forwarder itself.
B is the correct answer