Hi, I wanted to know that, if splunk Universal forwarder service is stopped for some time and then started again. When it starts forwarding the data again, does it forward the data from the time when it was stopped? More specifically, how many days' data would the universal forwarder forward,once its service is started again,if the service was stopped for a longer duration, say 10 days or so?
↧