Why do we need sometimes to bounce the forwarders for changes to take effect?

[ddrillic]

Why do we need sometimes to bounce the forwarders for changes to take effect? Just spent some time following the beloved instructions with no avail - I can't find my data!

I would suggest to add a forwarder bounce to this list ; -)

[skoelpin]

Anytime you make any server side changes it requires a restart because the server needs to see the new settings. If you make a CONF change while the server is running, its still using the old instructions to process the data. In my experience, the only time you don't need to restart after changing CONF files is anything at search time

[ddrillic]

Sorry @skoelpin, I guess I wasn't clear. I mean, I deployed via the deployer server, deployment apps to the 15 servers.

Ok, now I see, somebody made this change in serverclass.conf -

[global]
#restartSplunkWeb = 0
#restartSplunkd = 1
stateOnClient = enabled

Sorry ; -)