Getting Data In

Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

vikram_m
Path Finder

Hi,

I need to deploy an app from deplyment server which will restart the Splunkd UF application installed on Windows server.

Can some one please help me with what should I write in the $Splunk_Home/etc/deployment-apps/restart_app/local folder of Splunk.

Thanks.
Vikram.

0 Karma

abhijeet01
Path Finder

Hi @vikram_m

I don't have any idea about APP for restart UF.
But there is a script to restart the splunk service.

foreach ($server in Get-Content "c:\computers.txt" ) {
if (Test-Connection -ComputerName $Server -Count 2 -Quiet){
Write-Host "$Server is alive and Pinging " -ForegroundColor Green
}else{
Write-Warning "$Server seems dead not pinging"
}

set-location c:\program files\splunk\bin

Not sure about #4 regarding Splunk?

splunk list forward-server
Restart-Service
}

Don't forget to mention Interval to restart the splunk service.

0 Karma

nickhills
Ultra Champion

That is not something commonly reported - in fact I cant say i have ever heard of this being an issue!
(And I have 4000 windows UFs)

I think you would be better trying to triage the root cause of the problem.
As a start, for one of your forwarders which has "stopped reporting" can you obtain the splunkd.log from it?

If my comment helps, please give it a thumbs up!
0 Karma

vikram_m
Path Finder

Yes Nick,

I will be doing the same as starting the application the whole day is not a good option.

Thanks.
Vikram.

0 Karma

nickhills
Ultra Champion

How did you get on with this, did the logs indicate anything?

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

Can you explain the use case for this?
I have a couple of ideas, but wonder what is driving the requirement?

If my comment helps, please give it a thumbs up!
0 Karma

vikram_m
Path Finder

Hello Nick,

The use case here is Splunk is on Linux, UFs are on Windows. sometime the UFs stop reporting and once splunk serivce restarted things seem to work again.

So I wanted to develop an app which will restart the splunk service after every 30 min on the Windows servers.

0 Karma

DalJeanis
Legend

@nickhillscpl - yeah, this seems like setting up a repeating bazooka to fix an occasional handgun misfire. Better to clean and service the gun.

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...