Getting Data In

Is there a way to force UF to phone home to DS?

mjlsnombrado
Communicator

Hi All,

I just want to ask if there's a way to force UF to phone home to DS, we want to initiate a force phone home without editing the phone home interval under the deploymentclient.conf, currently the UF is set to phone home to the DS every 6 hours but we have a requirement that sometimes it is required to force phone home to the DS asap. I've already tried restarting the UF and running ./splunk reload deploy-server on the DS to see if it can trigger the UF to force phone home to the DS but it does not work, is there a way to do this, any suggestion can help.

Thanks and regards,
...

0 Karma

dchavda
Splunk Employee
Splunk Employee

i think i might have found something... 

i tested this by setting the phoneHomeIntervalInSecs = 3600 so that it only pulls the updates every hour 

and i found this REST call under REST API Reference Manual  and i tried to do so ...but the /reload does not seem to force the client to do phoneHome but i found another option in the response that i am able to use 

    <link href="/services/deployment/client/config" rel="list"/>
    <link href="/services/deployment/client/config" rel="edit"/>
    <link href="/services/deployment/client/config/reload" rel="reload"/>
    <link href="/services/deployment/client/config/sync" rel="sync"/>
    <content type="text/xml">

 

it is /sync 

so i tried using 

 curl -k -u username:pass -X POST https://<IP>:8089/services/deployment/client/deployment-client/sync

and it is helping me to have the client do phoneHome when i hit this url.

it also pulled the app updates which i did. 

This worked for me . 

0 Karma

woodcock
Esteemed Legend

The only way is to restart Splunk. One of the very first things that every Splunk does is DS phonehome.

0 Karma

skalliger
Motivator

No, I don't think there is a way to force any client. How many UFs do you have for such a high interval?

Skalli

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...