topic Re: Splunk Forwarder Restart Requirements when Deployed Apps are updated in Splunk Enterprise

Splunk Forwarder Restart Requirements when Deployed Apps are updated

shocko — Tue, 23 Jan 2024 13:23:37 GMT

I'm using Splunk Enterprise 9.x with Universal Forwarders 9.x on Windows 2019. All my forwarders are connected to a deployment server. I notice the following for example:

I update a deployment server app (say update inputs.conf with a new input stanza)
I restart the deployment server
I view the inputs at the forwarder using btool and see that my changes have propagated

However, even though the updated inputs.conf file seems to have landed at the forwarder I do not see the events defined by my new inputs.conf hitting the indexer until I restart the forwarder. Perhaps this is expected based on this When to restart Splunk Enterprise after a configuration file change - Splunk Documentation ?

Is this expected and if so is there any way to restart the forwarder remotely using Splunk itself?

Re: Splunk Forwarder Restart Requirements when Deployed Apps are updated

richgalloway — Tue, 23 Jan 2024 14:28:54 GMT

Any app containing inputs.conf should have the "Restart splunkd" option enabled. Do that in the Forwarder Management section of the Deployment Server. That will tell the UF to restart itself each time it gets an updated copy of the app.

Re: Splunk Forwarder Restart Requirements when Deployed Apps are updated

isoutamo — Thu, 25 Jan 2024 11:12:11 GMT

just like @richgalloway said. One comment about your "restart ds". It's not needed to restart it, just reload it's configuration for deployment part with command

splunk reload deploy-server

Or even add more granularity there it you have lot of configurations and restart or even base reload take too long.

r. Ismo

Re: Splunk Forwarder Restart Requirements when Deployed Apps are updated

shocko — Wed, 31 Jan 2024 17:39:46 GMT

I assumed (rather embarrassingly!) this restarted the deployment server splunkd! This is very useful.

Re: Splunk Forwarder Restart Requirements when Deployed Apps are updated

isoutamo — Thu, 01 Feb 2024 18:49:28 GMT

It’s not restarting Splunkd, it just reload deployment server DS related configurations. For that reason it’s much faster than restarting splunkd.