Deployment Architecture

does splunk indexer restart reload changes made on splunk forwader

Path Finder


I made some changes in inputs.conf in splunk forwarder of our several servers.Then I restarted the splunk indexer (splunk web) to reload the changes. But i noticed that the changes i made on splunk forwarders did not take i want to ask , does splunk indexer restart reload changes made on splunk forwader?Or i need to restart every splunk forwarder to reload the changes?please advise.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

A restart of an indexer will not cause changes made on the forwarders to take effect. If changes are made on the forwarder, then the forwarder instance needs to be restarted.

Note that when using Splunk deployment server, you can put a directive in the configuration to have the forwarder automatically restart upon receiving a change.

See restartSplunkd in the following doc:

Super Champion

To manage multiple severs of the same type, you should use a deployment server. In the serverclass.conf of the deployment server, which typically resides on the indexer you should specify restartSplunkd = true | false as true.
This will force the forwarders to restart after the update to the input.

0 Karma

Path Finder

Cool! thanks sbrant for your prompt response. I reaaly appreciate now i need to restart these 22 forwarders 🙂

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...