does splunk indexer restart reload changes made on splunk forwader

[Isaias_Garcia]

Hi-

I made some changes in inputs.conf in splunk forwarder of our several servers.Then I restarted the splunk indexer (splunk web) to reload the changes. But i noticed that the changes i made on splunk forwarders did not take effect.so i want to ask , does splunk indexer restart reload changes made on splunk forwader?Or i need to restart every splunk forwarder to reload the changes?please advise.

[sbrant_splunk]

A restart of an indexer will not cause changes made on the forwarders to take effect. If changes are made on the forwarder, then the forwarder instance needs to be restarted.

Note that when using Splunk deployment server, you can put a directive in the configuration to have the forwarder automatically restart upon receiving a change.

See restartSplunkd in the following doc: http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Serverclassconf

[lukejadamec]

To manage multiple severs of the same type, you should use a deployment server. In the serverclass.conf of the deployment server, which typically resides on the indexer you should specify restartSplunkd = true | false as true.
This will force the forwarders to restart after the update to the input.

[Isaias_Garcia]

Cool! thanks sbrant for your prompt response. I reaaly appreciate it..so now i need to restart these 22 forwarders 🙂