Getting Data In

Can I configure restartSplunkd to true for all applications?

spl_aficionado
Path Finder

Based on the Which apps need the restartSplunkd to be true? I would like to configure all apps to have restartSplunkd as true without specifying it explicitly. 

I added to the top of serverclass.conf - 

[global]
crossServerChecksum = true
restartSplunkd = true

[default]
restartSplunkd = true

 And still, after deploying an app, restartSplunkd at the app level is false on the UI. What am I missing?

Labels (2)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Usually I put its GUI immediately into "readonly mode". One way to do it is to modify serverclass.conf e.g.

###########################
## GUI Read Only setting ##
###########################
[global]
whitelist.0 = -

Basically just something wrong into stanza and then you cannot modify it with GUI, but GUI is for checking things.

If I recall correctly there was some "issue" to see those values in GUI (at least some older splunk versions) if you put those restartSplund into global/default. Those are working correctly, but GUI didn't show that those are present.

FYI: One nice app to do reloadds via GUI  https://splunkbase.splunk.com/app/7339

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The webUI does not support all possible settings and combinations thereof so maybe this one is not covered either.

I'd do a simple test - set your global parameters to restart=true, create a simple app without setting the restart option to anything and push it to just one forwarder. Verify if it restarts.

spl_aficionado
Path Finder

Thank you for your response, @PickleRick. I set up a small environment with the global restartSplunkd set to true and selected an app to deploy, and the UI still doesn't show it selected.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Yeah, that was predictable. But the question is whether the UF has restarted or not.

spl_aficionado
Path Finder

Thank you @PickleRick, the global stanzas worked perfectly fine. The only thing I missed was bouncing the deployment server. Many thanks.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Yeah, as I said - some more advanced configurations cannot be handled with GUI and you have to stick with manual fiddling with config files.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...