topic Re: How to apply changes to forwarders immediately from the deployment server? in Getting Data In

How to apply changes to forwarders immediately from the deployment server?

ManishaAgrawal — Mon, 24 Aug 2015 17:43:35 GMT

Hi all,

We have set property phoneHomeIntervalInSecs to 1 hour in deploymentclient.conf and pushed this app to forwarders. By doing this, forwarders only poll deployment server every one hour for updates. However, there is a requirement to apply changes immediately to these forwarders without waiting for the next time forwarder polls. In essence, instead of a forwarder doing a pull operation, requirement is that deployment server does a push operation when server class or apps associated with these forwarders are changed.

Example:
- Forwarder polled deployment server at, lets say 4pm
- Changes are applied to deployment server at 4:15 pm. This change is to stop data ingestion from forwarders.
- Since next poll will now be at 5pm, forwarder will not pick up this change till 5 and will continue to forward data.
- Requirement is to stop data ingestion and apply changes immediately to the forwarder.

Any ideas, how this can be done?

Thanks and Regards
Manisha

Re: How to apply changes to forwarders immediately from the deployment server?

mattlucas1 — Mon, 24 Aug 2015 18:36:12 GMT

You can use splunk debug refresh
http://ip:port/debug/refresh
Then you can restart splunk on your forwarders for an instant update.
instant=within 30 seconds

Re: How to apply changes to forwarders immediately from the deployment server?

diogofgm — Mon, 24 Aug 2015 20:25:05 GMT

The poll will always be initiated by the client, so restarting the client would probably be the solution. To force a deploy you can use:

./splunk reload deploy-server

But then again this would only push new configs/apps when the client polls the deployment server.
I was wondering why use 1 hour interval? For what I read one deployment server with the default times can handle about 300 clients. Even if you have more than 300 I don't think you need to raise the interval to 1 hour. If you have a huge amount of clients have you considered using multiple deployment server? Or a tiered solution?