Deployment Architecture

whats the difference between issueReload and restartSplunkd in serverclass.conf ?

damode
Motivator

As per the docs, issueReload determines whether the client's splunkd reloads after receiving an update and
restartSplunkd determines whether the client's splunkd restarts after receiving an update.

Can somebody please explain what happens internally in Splunk when client reloads vs client restarts ?

0 Karma

duartet
Path Finder
From: https://docs.splunk.com/Documentation/Splunk/8.0.6/Admin/Serverclassconf

restartSplunkd = <boolean> * If true, restarts splunkd on the client when a member app or a directly configured app is updated. * Can be overridden at the serverClass level and the serverClass:app level. * Default: false issueReload = <boolean> * If true, triggers a reload of internal processors at the client when a member app or a directly configured app is updated. * If you don't want to immediately start using an app that is pushed to a client, you should set this to false. * Default: false

Here you have the behavior of combining the options:
https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Useserverclass.conf

Interaction of restartSplunkd and issueReload

The behavior of the client varies depending on the settings of restartSplunkd and issueReload. These are the options:

issueReload restartSplunkd Behavior

truefalseReload only. No restart. It might be necessary to issue a manual restart to fully activate the downloaded apps.
truetrueClient reloads. If some app components require a restart to activate, the client restarts.
falsefalseThe downloaded apps are not activated.
falsetrueThe client always restarts after app updates.

 

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...