Getting Data In

What are best practices for setting phoneHomeInterval between deployment clients when under the same deployment server?

bheemireddi
Communicator

Hello,

I have been testing the configurations between DS and the clients. Currently I just have few clients to the DS and they all have the default setting for the phoneHomeinterval. in one of the scenarios, Forwarders downloaded the configs before the indexers and they tried to forward the data to an un-configured index as the Indexers downloaded their configs (that creates the index) few Secs later than the forwarders. So wanted to set the phoneHomeInterval differently for the indexers and forwarders so they align correctly. So is it the best practice to set different PhoneHomeInterval between Indexers and Forwarders (Even just for few clients) when they are under same DS? or is there a better approach to resolve this?

Thanks
Raji

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Changing the interval is not going to solve this. Let's be extreme and say indexers check every ten seconds while forwarders check every ten days. There still will be a case where eventually one forwarder's ten day interval will be up just after you deployed changes, and it will restart faster than your indexers.

To get around this, make changes to your indexer's server classes first. Reload deployment server, wait. Then make changes to forwarder server classes, reload, wait.

Even better, use clustering and roll out indexer changes from the master before touching the deployment server and therefore the forwarders.

Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...