Getting Data In

How to apply changes to forwarders immediately from the deployment server?


Hi all,

We have set property phoneHomeIntervalInSecs to 1 hour in deploymentclient.conf and pushed this app to forwarders. By doing this, forwarders only poll deployment server every one hour for updates. However, there is a requirement to apply changes immediately to these forwarders without waiting for the next time forwarder polls. In essence, instead of a forwarder doing a pull operation, requirement is that deployment server does a push operation when server class or apps associated with these forwarders are changed.

- Forwarder polled deployment server at, lets say 4pm
- Changes are applied to deployment server at 4:15 pm. This change is to stop data ingestion from forwarders.
- Since next poll will now be at 5pm, forwarder will not pick up this change till 5 and will continue to forward data.
- Requirement is to stop data ingestion and apply changes immediately to the forwarder.

Any ideas, how this can be done?

Thanks and Regards


The poll will always be initiated by the client, so restarting the client would probably be the solution. To force a deploy you can use:

./splunk reload deploy-server

But then again this would only push new configs/apps when the client polls the deployment server.
I was wondering why use 1 hour interval? For what I read one deployment server with the default times can handle about 300 clients. Even if you have more than 300 I don't think you need to raise the interval to 1 hour. If you have a huge amount of clients have you considered using multiple deployment server? Or a tiered solution?

Hope I was able to help you. If so, some karma would be appreciated.


You can use splunk debug refresh
Then you can restart splunk on your forwarders for an instant update.
instant=within 30 seconds

0 Karma
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...