Deployment Architecture

How to update outputs.conf

a212830
Champion

Hi,

I have a new indexer that is ready to be used. My question is how do I get my hundreds of FWD's to pick it up? We have an app that controls the outputs.conf, but even if I update it, will the forwarder restart?

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

If your forwarders are using a deployment server, and you have the

restartSplunkd = true 

configured, then yes your clients will automatically restart and pick up the new indexer. If you do not have this set, then it download the new outputs.conf, but it wont apply it till the service is restarted.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

If your forwarders are using a deployment server, and you have the

restartSplunkd = true 

configured, then yes your clients will automatically restart and pick up the new indexer. If you do not have this set, then it download the new outputs.conf, but it wont apply it till the service is restarted.

Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...