Getting Data In

How to apply changes to forwarders immediately from the deployment server?

ManishaAgrawal
Explorer

Hi all,

We have set property phoneHomeIntervalInSecs to 1 hour in deploymentclient.conf and pushed this app to forwarders. By doing this, forwarders only poll deployment server every one hour for updates. However, there is a requirement to apply changes immediately to these forwarders without waiting for the next time forwarder polls. In essence, instead of a forwarder doing a pull operation, requirement is that deployment server does a push operation when server class or apps associated with these forwarders are changed.

Example:
- Forwarder polled deployment server at, lets say 4pm
- Changes are applied to deployment server at 4:15 pm. This change is to stop data ingestion from forwarders.
- Since next poll will now be at 5pm, forwarder will not pick up this change till 5 and will continue to forward data.
- Requirement is to stop data ingestion and apply changes immediately to the forwarder.

Any ideas, how this can be done?

Thanks and Regards
Manisha

diogofgm
SplunkTrust
SplunkTrust

The poll will always be initiated by the client, so restarting the client would probably be the solution. To force a deploy you can use:

./splunk reload deploy-server

But then again this would only push new configs/apps when the client polls the deployment server.
I was wondering why use 1 hour interval? For what I read one deployment server with the default times can handle about 300 clients. Even if you have more than 300 I don't think you need to raise the interval to 1 hour. If you have a huge amount of clients have you considered using multiple deployment server? Or a tiered solution?

------------
Hope I was able to help you. If so, some karma would be appreciated.

mattlucas1
Engager

You can use splunk debug refresh
http://ip:port/debug/refresh
Then you can restart splunk on your forwarders for an instant update.
instant=within 30 seconds

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...