Getting Data In

Deployment Server - reload configs without restarting splunk?

tollops
Explorer

Hi;

We are currently setting up multiple new forwarders, which are getting their configs from the deployment server.

Everytime, we setup a new app or modify an existing app we are having to restart splunk.

Is there an easier way to re-initialise the Deployment Server to refresh the /opt/splunk/var/run/tmp/ sub-folders without having to do a "service restart splunk"

Trevor..

Labels (1)

iamarkaprabha
Contributor

Yes , You can create a server class for restart . Add the restart app and clients for it.
It will work like smooth

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

You might want to look at https://splunkbase.splunk.com/app/2775/
it has a relod deploy server as well as restart forwarder feature.

0 Karma

mlconnor
Explorer

If you are getting this error

An error occurred: Could not create Splunk settings directory at '/root/.splunk'

Then make sure you run the process as the user you typically run splunk from. splunk in my case.

sudo su splunk
[splunk@servername5001 /opt/splunk/etc](603)
$ /opt/splunk/bin/splunk reload deploy-server
Your session is invalid.  Please login.
Splunk username: admin
Password: 
Login successful, running command...
Reloading serverclass(es).
[splunk@servername /opt/splunk/etc](604)

BG
Explorer

I realise this post is 6 years old, but it still helped me.

Just to add something that might be useful:

When it asks for the Splunk username, this isn't a Linux user account, it's an application user account on the Deployment Server. It's confusing because many other Splunk commands can be run by Linux user accounts, but it seems not the 'deploy-server reload' command.

$ /opt/splunk/bin/splunk reload deploy-server
Your session is invalid.  Please login.
Splunk username: admin

Also, you can append '-class [serverclass name] onto the end of the command and only changes made to the corresponding deployment apps will get reloaded, so this is perhaps a safer option if you're nervous about reloading everything.

0 Karma

kskujawa
Explorer

I have a dummy app that I push when I want to make changes. Just add that app and next check in all updated apps get pushed.

0 Karma

lukejadamec
Super Champion

Great, help out and accept the right answer or post a better one.

0 Karma

tollops
Explorer

Bingo. We have success.
Thanks Peoples.. 🙂

joshd
Builder

Should be able to reload the configs by accessing http://yoursplunkinstance/en-US/debug/refresh

0 Karma

kristian_kolb
Ultra Champion

that takes longer time, and it reloads a bunch of other stuff. I think it's generally better suited for reloading props/transforms stuff that would normally require a restart.

0 Karma

tyronetv
Communicator

According to http://wiki.splunk.com/Deploy:DeploymentServer it is $SPLUNK_HOME/bin/splunk reload deploy-server

There is other information there but I think that answers you question.

matthewpearce
Explorer

For larger deployments, I think it's better to use the -class switch
${SPLUNK_HOME}/bin/splunk reload deploy-server -class

Tags (1)

rahulkumar02
Engager

This helped me a lot. Thank You!

Tags (1)
0 Karma

lukejadamec
Super Champion

Big fan of reload deploy-server myself.

ben_leung
Builder

Can anyone second that this is the endpoint for the command?

/services/deployment/client/config/reload -X POST

0 Karma

RaviNandasana0
Explorer

You can use below code to reload DS

from splunklib.binding import HTTPError
import splunk.clilib.cli_common as scc

def trigger_reload_deploy_server(self, sc=None):
    """Triggers the 'reload deploy-server' command via the Splunk REST API."""
    try:
        # Trigger the 'reload deploy-server' command using the REST API
        log("INFO","Triggering 'reload deploy-server' command.",file_name="getdiaginfo")
        splunkd_uri = scc.getMgmtUri()
        session_key = self.service.token
        
        endpoint = splunkd_uri + "/services/deployment/server/config/_reload"
        headers = {"Authorization": f"Splunk {session_key}", "Content-Type": "application/json"}
        
        # Prepare the request body
        if not sc:
            body = ''
        else:
            body = urllib.parse.urlencode({"serverclass": sc})
        update_response = requests.post(endpoint, headers=headers, data=body, verify=False)
 
        if update_response.status_code == 200:
            log("INFO", "--> 'reload deploy-server' command triggered successfully.", file_name="getdiaginfo")
            return True
        else:
            log("ERROR", f"Failed to trigger 'reload deploy-server'. Status: {update_response.status_code}, Response: {update_response.text}", file_name="getdiaginfo")
            return False
        
    except HTTPError as e:
        log("ERROR",f"Failed to trigger 'reload deploy-server': {e}",file_name="getdiaginfo")
        return False

@Configuration()
class Getdiaginfo(GeneratingCommand):
    server_list = Option(require=False)
    def generate(self):
        trigger_reload_deploy_server(self, <"serverclass-name">)

dispatch(Getdiaginfo, sys.argv, sys.stdin, sys.stdout, __name__)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Another app in splunkbase for this https://splunkbase.splunk.com/app/7339
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...