Getting Data In
Highlighted

Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

Path Finder

Hi,

I need to deploy an app from deplyment server which will restart the Splunkd UF application installed on Windows server.

Can some one please help me with what should I write in the $SplunkHome/etc/deployment-apps/restartapp/local folder of Splunk.

Thanks.
Vikram.

0 Karma
Highlighted

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

Ultra Champion

Can you explain the use case for this?
I have a couple of ideas, but wonder what is driving the requirement?

0 Karma
Highlighted

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

SplunkTrust
SplunkTrust

@nickhillscpl - yeah, this seems like setting up a repeating bazooka to fix an occasional handgun misfire. Better to clean and service the gun.

0 Karma
Highlighted

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

Path Finder

Hello Nick,

The use case here is Splunk is on Linux, UFs are on Windows. sometime the UFs stop reporting and once splunk serivce restarted things seem to work again.

So I wanted to develop an app which will restart the splunk service after every 30 min on the Windows servers.

0 Karma
Highlighted

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

Ultra Champion

That is not something commonly reported - in fact I cant say i have ever heard of this being an issue!
(And I have 4000 windows UFs)

I think you would be better trying to triage the root cause of the problem.
As a start, for one of your forwarders which has "stopped reporting" can you obtain the splunkd.log from it?

0 Karma
Highlighted

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

Path Finder

Yes Nick,

I will be doing the same as starting the application the whole day is not a good option.

Thanks.
Vikram.

0 Karma
Highlighted

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

Ultra Champion

How did you get on with this, did the logs indicate anything?

0 Karma
Highlighted

Re: Is there an app that can restart the Splunk universal forwarder service on Windows every 30 minutes?

Path Finder

Hi @vikram_m

I don't have any idea about APP for restart UF.
But there is a script to restart the splunk service.

foreach ($server in Get-Content "c:\computers.txt" ) {
if (Test-Connection -ComputerName $Server -Count 2 -Quiet){
Write-Host "$Server is alive and Pinging " -ForegroundColor Green
}else{
Write-Warning "$Server seems dead not pinging"
}

set-location c:\program files\splunk\bin

Not sure about #4 regarding Splunk?

splunk list forward-server
Restart-Service
}

Don't forget to mention Interval to restart the splunk service.

0 Karma