Splunk Deployment App Configurations on Universal Forwarder not Working

[knutsod]

I am using a deployment server to push out an "app" that has an input.conf file and output.conf file in the local directory of the app. The app is being pushed out to the clients and the configs look fine; however the config does not seem to be applied. I have a feeling I need to restart the Splunk Forwarder service, but there must be a way to automate this. Having to restart the service on the many servers this app applies to seems silly. Any suggestions?

[lguinn2]

In the serverclass.conf file, you can specify that the forward restart after installing a new (or updated) app. You can set this at the global level, for a serverclass, or for an app+serverclass combination:

[global]
restartSplunkd = true

[serverClass:MyServerGroup]
restartSplunkd = true

[serverClass:MyServerGroup:app:MyExampleApp]
restartSplunkd = true

Obviously, choose the level that works best for you!

[knutsod]

I have this configured, I think the problem might be else ware. It seems to me that the config is just not applying.

[DaClyde]

Did you ever get a resolution on this? I'm experiencing the same thing. I have two tomcat servers with forwarders configured as deployment clients. Both accepted the deployment app, but neither would forward anything or even acknowledge the monitor stanza in the inputs.conf.

I took the inputs.conf out of the app folder on one of the forwarders and copied it into the etc/system/local folder, restarted the forwarder and it started working! So why is the same inputs.conf working in etc/system/local but not etc/apps/tomcat/local?

[DaClyde]

Nevermind, I just upgraded my forwarders from 6.4.1 to 6.5.0 and the problem went away. My forwarders are now acknowledging the deployed apps.

[dshpritz]

Note that the globals, I don't believe, are supported by the Forwarder Management pages in Splunk 6+.