Getting Data In

Is there a way to force a single deployment client to check in with the deployment server on demand?

dstaulcu
Builder

Is there a way to force a deployment client to check in with deployment server on demand?

During tests I normally alter the phoneHomeInterval of client from it's default of something conservative (hours) to something aggressive (seconds) on the client. -Just wondering if there is another (one-time) option that I have overlooked.

Inputs appreciated.

valiquet
Contributor

I don't think you can't. I managed over 1000k UF with 10 seconds interval between phone homes without any issues.

0 Karma

pradeepkumarg
Influencer

Did you figure out any solution for this?

0 Karma

dstaulcu
Builder

Here is a powershell script I made to automate the task on windows-based clients.

0 Karma

Kate_Lawrence-G
Contributor

a restart of the forwarder will force a check.
Just make sure your deploymentclient.conf is set correctly.

0 Karma

dstaulcu
Builder

That doesn't work for me on universal forwarders... most recent test was on 6.1.2. Is your experience of a restart doing the trick on universal forwarders or on splunk servers? If at all with UF, which version?

0 Karma

jkat54
SplunkTrust
SplunkTrust

doesnt work for me either on a heavy forwarder / search head.

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...