Deployment Architecture

How to update outputs.conf

a212830
Champion

Hi,

I have a new indexer that is ready to be used. My question is how do I get my hundreds of FWD's to pick it up? We have an app that controls the outputs.conf, but even if I update it, will the forwarder restart?

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

If your forwarders are using a deployment server, and you have the

restartSplunkd = true 

configured, then yes your clients will automatically restart and pick up the new indexer. If you do not have this set, then it download the new outputs.conf, but it wont apply it till the service is restarted.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

If your forwarders are using a deployment server, and you have the

restartSplunkd = true 

configured, then yes your clients will automatically restart and pick up the new indexer. If you do not have this set, then it download the new outputs.conf, but it wont apply it till the service is restarted.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...