topic Re: Can I stop splunk universal forwarder at once from deployment server or any other apps? in Splunk Enterprise

Can I stop splunk universal forwarder at once from deployment server or any other apps?

Moon629 — Wed, 23 Dec 2015 02:17:54 GMT

Hi all

There are lots of splunk universal forwarders installed in application servers, and managed by deployment server. Can I stop all the UFs at once from deployment server? Or from any other apps?

Thanks in advance!

Re: Can I stop splunk universal forwarder at once from deployment server or any other apps?

milesbrennan — Wed, 23 Dec 2015 05:04:31 GMT

I found the easiest way is to remove all the associated applications from the serverclass, and reload the deployment server. Then once the deployment client checks back in, it removes the application, and will not collect or send any data.

The fishbucket keeps track of the data logs you have already collected, so when you re-apply the applications, you don't get a double-up of event entries.

# Enable the DHCP input from Splunk_TA_windows
[serverClass:WinDHCP]
whitelist.0 = DCSERVER-AU
whitelist.1 = DCSERVER-UK
whitelist.2 = DCSERVER-US
whitelist.3 = DCSERVER-EU
whitelist.4 = DCSERVER-NZ
#[serverClass:WinDHCP:app:deploymentclient]        <-- remark out the application association
#[serverClass:WinDHCP:app:output_all]              <-- remark out the application association
#[serverClass:WinDHCP:app:Splunk_TA_windows]       <-- remark out the application association
#[serverClass:WinDHCP:app:AAA_windows_dhcp]        <-- remark out the application association

Save the "serverclass.conf" file and issue the deployment server a reload.

/opt/splunk/bin/splunk reload deploy-server

Re: Can I stop splunk universal forwarder at once from deployment server or any other apps?

Moon629 — Wed, 23 Dec 2015 05:55:29 GMT

Thank you and yes, we can remove the configuration applied to the application servers. But can we stop the ufs? like running: ./splunk stop.....which don't need to login to application servers?

Re: Can I stop splunk universal forwarder at once from deployment server or any other apps?

milesbrennan — Wed, 23 Dec 2015 06:18:55 GMT

No, not natively from the central deployment server. If you accidently stopped all the universal forwarders from the deployment server, you could be in some pretty big trouble, as you wouldn't be able to restart the remote Splunk services if they were all stopped.

Next best option is to remove the applications and allow the forwarders to remain active, polling the deployment server in case you make configuration changes or push out their applications again.

Allowing the forwarders to remain active in the OS would probably be best, and only use minimal resources sitting in memory doing nothing.

Re: Can I stop splunk universal forwarder at once from deployment server or any other apps?

javiergn — Wed, 23 Dec 2015 06:26:24 GMT

You could always deploy an app that contains a Python, PowerShell or whatever other script language you want to use and run a splunk stop from there.

Splunk should run this and stop itself in theory.

But keep in mind you won't be able to undo this very easily. If your script creates a schedule or cron task that starts splunk automatically after a certain period, you might be able to overcome the issue.

Hope that helps.

Thanks,
J

Re: Can I stop splunk universal forwarder at once from deployment server or any other apps?

Moon629 — Wed, 23 Dec 2015 06:36:10 GMT

Thank you. Since the admin of the application servers concern that if ufs spent lots of resource, and influence the application, he hope that we can stop all at once.

but I think you are correct. if ufs spent lots of resource, which means read and forward lots of data. So remove the inputs and outputs configuration maybe the effective way.

Re: Can I stop splunk universal forwarder at once from deployment server or any other apps?

Moon629 — Wed, 23 Dec 2015 06:37:04 GMT

Any app already created in splunk apps for this?

Re: Can I stop splunk universal forwarder at once from deployment server or any other apps?

javiergn — Wed, 23 Dec 2015 22:41:00 GMT

I don't think so.
Depending on your needs and your environment you could use PowerShell on Windows hosts and Python everywhere else. Or just use Python everywhere.

Take a look at the following posts and see if that helps. All you need to do is to deploy your app that runs your script via inputs.conf:

https://answers.splunk.com/answers/212331/can-i-use-a-python-script-on-a-windows-universal-f.html
http://docs.splunk.com/Documentation/Splunk/latest/Admin/StartSplunk

If you are running 6.3 you can natively run PowerShell scripts too. See the following links:

http://docs.splunk.com/Documentation/AddOns/latest/MSPowerShell/Configuration
https://technet.microsoft.com/en-us/library/ee177005.aspx

For instance, your inputs.conf could be something like:

# Restart SplunkForwarder on Windows on December 24th (note this will run every year so make sure you disable the app)
[powershell://Restart-Splunk]
script = Stop-Service SplunkForwarder
schedule = 0 10 24 12 *
sourcetype = MySourceType

Hope that helps.

Thanks,
J