topic Re: Deploying a simple TA to indexers - rolling restart required? in Splunk Enterprise

Deploying a simple TA to indexers - rolling restart required?

danielbb — Fri, 17 May 2024 20:43:55 GMT

We want to add a TA (app) to our indexers at the path /opt/splunk/etc/master-apps by running the command /opt/splunk/bin/splunk apply cluster-bundle

My question is if we can deploy an indexer app without a restart of the indexer? The TA we want to deploy is an extension to the nix TA, and all it does is run some simple bash scripted inputs.

Re: Deploying a simple TA to indexers - rolling restart required?

PickleRick — Fri, 17 May 2024 20:48:38 GMT

See here:

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Updatepeerconfigurations#Restart_or_reload_after_configuration_bundle_changes.3F

And here:

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Updatepeerconfigurations#Use_the_CLI_to_validate_the_bundle_and_check_restart

Re: Deploying a simple TA to indexers - rolling restart required?

danielbb — Sun, 19 May 2024 18:54:10 GMT

Thank you so much, one of our stanzas looks like the following -

[script://./bin/ulimit.sh] interval = 27 5 * * * source = scripted_input sourcetype = virtualization:sanity:ulimit index = os disabled = false

Based on the link you provided, a reload should be fine. How would we run a "reload"?

inputs.conf	http	reload
inputs.conf	script	reload
inputs.conf	monitor	reload
inputs.conf	<modular_input>	reload
inputs.conf	batch	reload