topic Re: Splunk Deployment App Configurations on Universal Forwarder not Working in Getting Data In

Splunk Deployment App Configurations on Universal Forwarder not Working

knutsod — Tue, 24 Jun 2014 21:57:12 GMT

I am using a deployment server to push out an "app" that has an input.conf file and output.conf file in the local directory of the app. The app is being pushed out to the clients and the configs look fine; however the config does not seem to be applied. I have a feeling I need to restart the Splunk Forwarder service, but there must be a way to automate this. Having to restart the service on the many servers this app applies to seems silly. Any suggestions?

Re: Splunk Deployment App Configurations on Universal Forwarder not Working

lguinn2 — Tue, 24 Jun 2014 22:23:33 GMT

In the serverclass.conf file, you can specify that the forward restart after installing a new (or updated) app. You can set this at the global level, for a serverclass, or for an app+serverclass combination:

[global]
restartSplunkd = true

[serverClass:MyServerGroup]
restartSplunkd = true

[serverClass:MyServerGroup:app:MyExampleApp]
restartSplunkd = true

Obviously, choose the level that works best for you!

Re: Splunk Deployment App Configurations on Universal Forwarder not Working

dshpritz — Tue, 24 Jun 2014 22:34:40 GMT

Note that the globals, I don't believe, are supported by the Forwarder Management pages in Splunk 6+.

Re: Splunk Deployment App Configurations on Universal Forwarder not Working

knutsod — Tue, 24 Jun 2014 23:07:05 GMT

I have this configured, I think the problem might be else ware. It seems to me that the config is just not applying.

Re: Splunk Deployment App Configurations on Universal Forwarder not Working

DaClyde — Wed, 16 Nov 2016 21:23:32 GMT

Did you ever get a resolution on this? I'm experiencing the same thing. I have two tomcat servers with forwarders configured as deployment clients. Both accepted the deployment app, but neither would forward anything or even acknowledge the monitor stanza in the inputs.conf.

I took the inputs.conf out of the app folder on one of the forwarders and copied it into the etc/system/local folder, restarted the forwarder and it started working! So why is the same inputs.conf working in etc/system/local but not etc/apps/tomcat/local?

Re: Splunk Deployment App Configurations on Universal Forwarder not Working

DaClyde — Thu, 17 Nov 2016 15:11:53 GMT

Nevermind, I just upgraded my forwarders from 6.4.1 to 6.5.0 and the problem went away. My forwarders are now acknowledging the deployed apps.