I just wanted to confirm something...
I have a deployment set up, where the deployment server maintains list of hosts in a text files, called
hosts.txt, which differ based on the forwarder. These files and their parent deployment-apps are distributed as expected to the relevant forwarders (based on whitelisting). The
hosts.txt file are referenced by a python script, which is configured as a scripted input.
The deployment update/reload process seems to work fine, apart from one aspect, the python script does not seem to read the updates in the file until after a reboot. To expand on this...
If, for example, I add the line
22.214.171.124 to the
hosts.txt file in the deployment-app,
$SPLUNK_HOME/etc/deployment-apps/foo), and reload the deployment (as @dart points out using the
./splunk reload deploy-server command). I will see the updated list on the forwarder under
$SPLUNK_HOME/etc/apps/foo, however the script will not "see" the new entry (i.e. "
126.96.36.199") until I restart Splunk on the forwarder.
When I had this python script/hosts file combo working on a single server in test, it worked fine. And the script would pick up the update on the next interval cycle. I'm just wondering why I now have to reboot.
Has anyone any thoughts on this?
what's the hosts file you're refering to? if it's deploymentclasses.conf, you need to do a splunk reload deploy-server to get the new definitions
@dart, I re-read my question, and have subsequently updated it (all), so that it makes sense to everyone else, and not just myself. The "hosts file" is a file I use to maintain list of hosts to be used by a scripted input for data collection, which may need to change at various points in the future.. So I use the hosts file to avoid "hard-coding" anything.
I have used
restartSplunkd since I noticed the scripted input wasn't picking up the change, and it does work, however I was just curious if there was something I should be looking out for. I haven't really looked into modular inputs (or splunk 5) as the time left for this particular project is running out very soon.
Okay so my work around to avoid restarting Splunk each time a new host is added was to write the updates to a seperate deployment-app.. So two apps get sent out, one containing the collection script, one containing the the hosts file. This appears to work without requiring a restart.