Deployment Architecture

does splunk indexer restart reload changes made on splunk forwader

Isaias_Garcia
Path Finder

Hi-

I made some changes in inputs.conf in splunk forwarder of our several servers.Then I restarted the splunk indexer (splunk web) to reload the changes. But i noticed that the changes i made on splunk forwarders did not take effect.so i want to ask , does splunk indexer restart reload changes made on splunk forwader?Or i need to restart every splunk forwarder to reload the changes?please advise.

Tags (1)
0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

A restart of an indexer will not cause changes made on the forwarders to take effect. If changes are made on the forwarder, then the forwarder instance needs to be restarted.

Note that when using Splunk deployment server, you can put a directive in the configuration to have the forwarder automatically restart upon receiving a change.

See restartSplunkd in the following doc: http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Serverclassconf

lukejadamec
Super Champion

To manage multiple severs of the same type, you should use a deployment server. In the serverclass.conf of the deployment server, which typically resides on the indexer you should specify restartSplunkd = true | false as true.
This will force the forwarders to restart after the update to the input.

0 Karma

Isaias_Garcia
Path Finder

Cool! thanks sbrant for your prompt response. I reaaly appreciate it..so now i need to restart these 22 forwarders 🙂

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...