Getting Data In

When making changes to .conf files in a distributed environment, how do I make sure changes get pushed to indexers and forwarders?

omuelle1
Communicator

HI,

I got a question about how to most efficiently change .conf settings in a distributed environment.

For example: I just made a change in my inputs.conf file for an app on my search head in the deployment apps folder. From what I remember, the indexers and forwarders should recognize that a change was made and pull the new file over. However, only the files are being changed on the forwarders, the indexers do not update the files. Any idea how to change that?

Oliver

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

In the scenario you are describing, there are a few points to clarify and understand...

1) If you put the app in the deployment-apps folder on the Search Head (SH), the SH takes on the role of a deployment server.
2) Your clients (forwarders) need to be connected to the deployment server and associated to the proper serverclasses.conf.
3) The indexer(s) need to have the same configuration and point to the deployment server. **** HOWEVER **** If you are using a clustered indexer, then you SHOULD NOT connect your indexers to the deployment server. This is not supported and can cause problems. ( http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Manageappdeployment)
4) If your indexers are "standalone", then it should work as you describe, check your deploymentclient.conf on your indexers. If your indexers are clustered, you need to distribute configs either manually or via master-apps on the Cluster Master node.

So depending on your environment, your answer has a couple different options.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

In the scenario you are describing, there are a few points to clarify and understand...

1) If you put the app in the deployment-apps folder on the Search Head (SH), the SH takes on the role of a deployment server.
2) Your clients (forwarders) need to be connected to the deployment server and associated to the proper serverclasses.conf.
3) The indexer(s) need to have the same configuration and point to the deployment server. **** HOWEVER **** If you are using a clustered indexer, then you SHOULD NOT connect your indexers to the deployment server. This is not supported and can cause problems. ( http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Manageappdeployment)
4) If your indexers are "standalone", then it should work as you describe, check your deploymentclient.conf on your indexers. If your indexers are clustered, you need to distribute configs either manually or via master-apps on the Cluster Master node.

So depending on your environment, your answer has a couple different options.

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...