topic Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes? in Getting Data In

Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

vikram_m — Tue, 29 Sep 2020 17:13:51 GMT

Hi,

I need to deploy an app from deplyment server which will restart the Splunkd UF application installed on Windows server.

Can some one please help me with what should I write in the $Splunk_Home/etc/deployment-apps/restart_app/local folder of Splunk.

Thanks.
Vikram.

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

nickhills — Wed, 13 Dec 2017 13:21:29 GMT

Can you explain the use case for this?
I have a couple of ideas, but wonder what is driving the requirement?

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

DalJeanis — Wed, 13 Dec 2017 15:49:49 GMT

@nickhillscpl - yeah, this seems like setting up a repeating bazooka to fix an occasional handgun misfire. Better to clean and service the gun.

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

vikram_m — Thu, 14 Dec 2017 07:17:36 GMT

Hello Nick,

The use case here is Splunk is on Linux, UFs are on Windows. sometime the UFs stop reporting and once splunk serivce restarted things seem to work again.

So I wanted to develop an app which will restart the splunk service after every 30 min on the Windows servers.

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

nickhills — Thu, 14 Dec 2017 08:27:02 GMT

That is not something commonly reported - in fact I cant say i have ever heard of this being an issue!
(And I have 4000 windows UFs)

I think you would be better trying to triage the root cause of the problem.
As a start, for one of your forwarders which has "stopped reporting" can you obtain the splunkd.log from it?

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

vikram_m — Thu, 14 Dec 2017 08:54:16 GMT

Yes Nick,

I will be doing the same as starting the application the whole day is not a good option.

Thanks.
Vikram.

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

nickhills — Tue, 19 Dec 2017 10:19:59 GMT

How did you get on with this, did the logs indicate anything?

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

abhijeet01 — Thu, 21 Dec 2017 08:30:21 GMT

Hi @vikram_m

I don't have any idea about APP for restart UF.
But there is a script to restart the splunk service.

foreach ($server in Get-Content "c:\computers.txt" ) {
if (Test-Connection -ComputerName $Server -Count 2 -Quiet){
Write-Host "$Server is alive and Pinging " -ForegroundColor Green
}else{
Write-Warning "$Server seems dead not pinging"
}

set-location c:\program files\splunk\bin

Not sure about #4 regarding Splunk?

splunk list forward-server
Restart-Service
}

Don't forget to mention Interval to restart the splunk service.