topic Re: Splunk upgrade deployment server in Getting Data In

Splunk upgrade deployment server

menonmanish — Thu, 10 Mar 2016 20:34:12 GMT

During Splunk upgrade (5.0.5 to 6.2.5) of our indexers, search head, deployment server we have noticed that all the deployment apps get refreshed in all the deployment clients and a lot of the universal forwarders do not restart and we have to manually restart it. Note: We are not upgrading the universal forwarders. Is there a way to prevent this from happening. During the upgrade, i don't think any change should happen to the serverclass and/or the deployment apps for the clients to get refreshed.

Re: Splunk upgrade deployment server

vasildavid — Thu, 10 Mar 2016 21:47:13 GMT

I believe the serverclasses are refreshed when the deployment server is restarted. One way you could avoid the agent restart is to check in your serverclass.conf and remove/comment out any instances of restartSplunkd = true.

Re: Splunk upgrade deployment server

somesoni2 — Thu, 10 Mar 2016 21:59:55 GMT

My guess would be that version upgrade on Deployment Servers is causing the bundle checksum (a handler deployment clients use to check if there is updated apps are available in deployment server) to get changed and all deployment clients are downloading apps with updated checksum.

Re: Splunk upgrade deployment server

menonmanish — Fri, 11 Mar 2016 13:25:52 GMT

That seems to be the case, but any idea if its a known issue?