How to restart a universal forwarder remotely via deployment server?

[koshyk]

We are facing a few issues whereour endpoints (clients) may have the Splunk service stopped.
Can we force a restart of the Universal forwarder (agent) "splunk service" or "splunk" from our deployment server?

Currently, we are asking the support team of the respective application team to do it for us, but would be great if we can manage the agents ourselves. (BTW the agents have local accounts in the clients)

[gcusello]

Hi koshyk,
No you cannot if your Forwarder is stopped!
you can restart a Forwarder only if it runs and you deploy a TA on this Forwarder.
probablu the only way is a remote script shell.
Bye.
Giuseppe

[adayton20 · Accepted solution]

I do not know of a way to force restart a deployment client once it already stopped. After all, if the service is stopped, it can’t connect to the deployment server in the first place.

I used to work in an environment where we monitored for critical services stopping in Splunk, the Splunk service being one of them. Perhaps it would be a good idea to investigate why the service is stopping to verify nothing malicious is occurring. Should be Event ID 7036. You could do what we did and use a powershell script to restart the service should it stop. We ran the script in the background as a scheduled task every 15 minutes.

[koshyk]

+1 thanks for the tip of powershell script. hopefully will get more ideas from other people