Getting Data In

Splunk upgrade deployment server

menonmanish
Path Finder

During Splunk upgrade (5.0.5 to 6.2.5) of our indexers, search head, deployment server we have noticed that all the deployment apps get refreshed in all the deployment clients and a lot of the universal forwarders do not restart and we have to manually restart it. Note: We are not upgrading the universal forwarders. Is there a way to prevent this from happening. During the upgrade, i don't think any change should happen to the serverclass and/or the deployment apps for the clients to get refreshed.

0 Karma

somesoni2
Revered Legend

My guess would be that version upgrade on Deployment Servers is causing the bundle checksum (a handler deployment clients use to check if there is updated apps are available in deployment server) to get changed and all deployment clients are downloading apps with updated checksum.

0 Karma

menonmanish
Path Finder

That seems to be the case, but any idea if its a known issue?

0 Karma

vasildavid
Path Finder

I believe the serverclasses are refreshed when the deployment server is restarted. One way you could avoid the agent restart is to check in your serverclass.conf and remove/comment out any instances of restartSplunkd = true.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...