Getting Data In

Splunk Deployment App Configurations on Universal Forwarder not Working

knutsod
Path Finder

I am using a deployment server to push out an "app" that has an input.conf file and output.conf file in the local directory of the app. The app is being pushed out to the clients and the configs look fine; however the config does not seem to be applied. I have a feeling I need to restart the Splunk Forwarder service, but there must be a way to automate this. Having to restart the service on the many servers this app applies to seems silly. Any suggestions?

0 Karma

lguinn2
Legend

In the serverclass.conf file, you can specify that the forward restart after installing a new (or updated) app. You can set this at the global level, for a serverclass, or for an app+serverclass combination:

[global]
restartSplunkd = true

[serverClass:MyServerGroup]
restartSplunkd = true

[serverClass:MyServerGroup:app:MyExampleApp]
restartSplunkd = true

Obviously, choose the level that works best for you!

0 Karma

knutsod
Path Finder

I have this configured, I think the problem might be else ware. It seems to me that the config is just not applying.

0 Karma

DaClyde
Contributor

Did you ever get a resolution on this? I'm experiencing the same thing. I have two tomcat servers with forwarders configured as deployment clients. Both accepted the deployment app, but neither would forward anything or even acknowledge the monitor stanza in the inputs.conf.

I took the inputs.conf out of the app folder on one of the forwarders and copied it into the etc/system/local folder, restarted the forwarder and it started working! So why is the same inputs.conf working in etc/system/local but not etc/apps/tomcat/local?

0 Karma

DaClyde
Contributor

Nevermind, I just upgraded my forwarders from 6.4.1 to 6.5.0 and the problem went away. My forwarders are now acknowledging the deployed apps.

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Note that the globals, I don't believe, are supported by the Forwarder Management pages in Splunk 6+.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!