When making changes to .conf files in a distributed environment, how do I make sure changes get pushed to indexers and forwarders?

[omuelle1]

HI,

I got a question about how to most efficiently change .conf settings in a distributed environment.

For example: I just made a change in my inputs.conf file for an app on my search head in the deployment apps folder. From what I remember, the indexers and forwarders should recognize that a change was made and pull the new file over. However, only the files are being changed on the forwarders, the indexers do not update the files. Any idea how to change that?

Oliver

[esix_splunk · Accepted solution]

In the scenario you are describing, there are a few points to clarify and understand...

1) If you put the app in the deployment-apps folder on the Search Head (SH), the SH takes on the role of a deployment server.
2) Your clients (forwarders) need to be connected to the deployment server and associated to the proper serverclasses.conf.
3) The indexer(s) need to have the same configuration and point to the deployment server. **** HOWEVER **** If you are using a clustered indexer, then you SHOULD NOT connect your indexers to the deployment server. This is not supported and can cause problems. ( http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Manageappdeployment)
4) If your indexers are "standalone", then it should work as you describe, check your deploymentclient.conf on your indexers. If your indexers are clustered, you need to distribute configs either manually or via master-apps on the Cluster Master node.

So depending on your environment, your answer has a couple different options.