Based on the Which apps need the restartSplunkd to be true? I would like to configure all apps to have restartSplunkd as true without specifying it explicitly.
I added to the top of serverclass.conf -
[global]
crossServerChecksum = true
restartSplunkd = true
[default]
restartSplunkd = trueAnd still, after deploying an app, restartSplunkd at the app level is false on the UI. What am I missing?
Usually I put its GUI immediately into "readonly mode". One way to do it is to modify serverclass.conf e.g.
###########################
## GUI Read Only setting ##
###########################
[global]
whitelist.0 = -Basically just something wrong into stanza and then you cannot modify it with GUI, but GUI is for checking things.
If I recall correctly there was some "issue" to see those values in GUI (at least some older splunk versions) if you put those restartSplund into global/default. Those are working correctly, but GUI didn't show that those are present.
FYI: One nice app to do reloadds via GUI https://splunkbase.splunk.com/app/7339
The webUI does not support all possible settings and combinations thereof so maybe this one is not covered either.
I'd do a simple test - set your global parameters to restart=true, create a simple app without setting the restart option to anything and push it to just one forwarder. Verify if it restarts.
Thank you for your response, @PickleRick. I set up a small environment with the global restartSplunkd set to true and selected an app to deploy, and the UI still doesn't show it selected.
Yeah, that was predictable. But the question is whether the UF has restarted or not.
Thank you @PickleRick, the global stanzas worked perfectly fine. The only thing I missed was bouncing the deployment server. Many thanks.
Yeah, as I said - some more advanced configurations cannot be handled with GUI and you have to stick with manual fiddling with config files.