topic Re: How to restart Universal Forwarder from a Deploy Server? in Getting Data In

How to restart Universal Forwarder from a Deploy Server?

kisero — Fri, 02 Mar 2018 17:01:52 GMT

Hi,

I need restart many servers (Universal Forwarders) Unix from a Deploy Server.
Is there any way to do it?

Thanks!

Re: How to restart Universal Forwarder from a Deploy Server?

adonio — Fri, 02 Mar 2018 17:54:22 GMT

if they are talking to deployment server, you can pick an app that is deployed to all forwarders, probably an outputs app, and add the restart flag to it. then reload your apps to the forwarders
steps:
go to "forwarder Mangement" ->apps tab -> choose and app -> edit -> mark :Restart Splunkd" -> go to $SPLUNK_HOME/bin on Deploymet Server -> run: splunk reload deploy-server

hope it helps

Re: How to restart Universal Forwarder from a Deploy Server?

klemaned — Tue, 29 Sep 2020 21:23:07 GMT

We use a Splunk_Restart class with a dummy Splunk_Restart app that has "Restart Splunkd" enabled. When we want to restart a host we just add it to the clients list and remove it 5 minutes later.

This is only necessary if you're making changes to an already deployed .conf file. If you're making major changes, you can use ./splunk reload deploy-server -class

Re: How to restart Universal Forwarder from a Deploy Server?

ddrillic — Thu, 27 Sep 2018 14:29:37 GMT

Interesting thing @adonio - but we can't do anything (in the app context) if the forwarder is down, right? because I'm struggling with "my" forwarders that are occasionally down...

Re: How to restart Universal Forwarder from a Deploy Server?

nick405060 — Thu, 17 Jan 2019 19:07:15 GMT

thanks! this seems obvious but is not. fixed my problems not getting any data from my deployment clients even though the apps were pushed out successfully.

However I had to remove all my apps, reload deploy-server, and then add them again and reload in order for the restart to actually take place. I think the restart is only triggered during an initial app installation and not just when you update the app. Not positive about that though.

Re: How to restart Universal Forwarder from a Deploy Server?

nplamondon — Fri, 01 Mar 2019 20:22:15 GMT

Excellent solution, and added to my serverclass!

Re: How to restart Universal Forwarder from a Deploy Server?

dominiquevocat — Wed, 29 Apr 2020 14:28:38 GMT

There is such a feature in https://splunkbase.splunk.com/app/2775/ - one or recursively over a search result. You need to reach port 8089 on the forwarders though and set a password for admin.

Re: How to restart Universal Forwarder from a Deploy Server?

nplamondon — Thu, 21 May 2020 21:56:54 GMT

This is likely not an option for most people, as it would probably require firewall rules that no sane fw admin would create.

The existing answers are a much better solution.

Re: How to restart Universal Forwarder from a Deploy Server?

dominiquevocat — Fri, 22 May 2020 08:54:08 GMT

Not saying i disagree with you but would you care to explain how pushing arbitrary code for execution from a deployment server to any endpoint being run with potentially local system/root is saner and safer then using the splunk api remotely from the same box?

Re: How to restart Universal Forwarder from a Deploy Server?

rahulkumar02 — Fri, 12 Jun 2020 17:21:46 GMT

You can also restart by server class using the following command: /etc/splunk/bin- "splunk reload deploy-server -class ServerClassName".

Re: How to restart Universal Forwarder from a Deploy Server?

yannK — Fri, 12 Jun 2020 17:39:58 GMT

If the splunk service is down on the forwarder, then it cannot reach the deployment server, hence cannot receive the app update and restart request.

You may have to actually start splunk service directly on the client (with a CLI command or any remote admin management tool)

Re: How to restart Universal Forwarder from a Deploy Server?

shocko — Tue, 23 Jan 2024 13:38:12 GMT

So basically we can do the following:

Create a dummy app and assign system/UFs we wish to restart
Flag that app to restart with the checkbox
Restart depoyment server
Dummy app gets pushed to UF
UF reads it and restarts/reloads itself?

Re: How to restart Universal Forwarder from a Deploy Server?

PickleRick — Tue, 23 Jan 2024 13:55:05 GMT

Close.

You don't need to restart the DS. Just reload the deployment classes. (if you're doing it via CLI, if I remember correctly, the GUI takes care of that automatically)