We have set property phoneHomeIntervalInSecs to 1 hour in deploymentclient.conf and pushed this app to forwarders. By doing this, forwarders only poll deployment server every one hour for updates. However, there is a requirement to apply changes immediately to these forwarders without waiting for the next time forwarder polls. In essence, instead of a forwarder doing a pull operation, requirement is that deployment server does a push operation when server class or apps associated with these forwarders are changed.
- Forwarder polled deployment server at, lets say 4pm
- Changes are applied to deployment server at 4:15 pm. This change is to stop data ingestion from forwarders.
- Since next poll will now be at 5pm, forwarder will not pick up this change till 5 and will continue to forward data.
- Requirement is to stop data ingestion and apply changes immediately to the forwarder.
Any ideas, how this can be done?
Thanks and Regards
The poll will always be initiated by the client, so restarting the client would probably be the solution. To force a deploy you can use:
./splunk reload deploy-server
But then again this would only push new configs/apps when the client polls the deployment server.
I was wondering why use 1 hour interval? For what I read one deployment server with the default times can handle about 300 clients. Even if you have more than 300 I don't think you need to raise the interval to 1 hour. If you have a huge amount of clients have you considered using multiple deployment server? Or a tiered solution?