Getting Data In

Why does the Linux Centos Forwarder does not automatically load changes from inputs.conf?

magriii
Explorer

Hi,

We have some centos 7.4 systems with Splunk forwarder 7.0.0 installed.
Changes for data inputs are distributed to the agent's inputs.conf file, but the agent does not automatically use these new settings.
After we manually restart the Splunk service the updated inputs.conf file is read and used.

The agent is running under a dedicated account named Splunk. The Splunk account is added the /etc/sudoers file to allow restarting the Splunk services.

Thank you

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

HI magriii,
how do you deploy updates: using a Deployment Server or an external tool.

If Deployment Server, remember to check the Splunkd restart checkbox in ServerClass.
If an external tool, remember to restart Splunk after updates.

Bye.
Giuseppe

View solution in original post

0 Karma

magriii
Explorer

Hi and thanks to both comments.
I'm using the Splunk server as a deployment server and wasn't aware that I needed to enable the restart option.
Now as I better know where to search I found this Question that discusses the same issue.
link text

I've enabled these values and things are good.
restartSplunkd = true
issueReload = true
restartIfNeeded = true

0 Karma

tiagofbmm
Influencer

Hey

If you change the configuration files directly, splunk does not know you have changed something.

.conf files are never re-read before you actually restart Splunk, and that is actually the expected behaviour.

As @cusello has mentioned, if you are using a deployment server to pull changes to the Universal Forwarders, then you should make sure that:

  • after changing some configuration in an app under deployment_apps, you must splunk repload deploy-server in order to make the DS aware you changed things are recreate a checksum of what you have in the app
  • the serverclass should have the option "restart splunk" enabled so your Universal Forwarders restart automatically and your changes turn into runtime configurations.

https://docs.splunk.com/Documentation/MSApp/1.4.3/MSInfra/Setupadeploymentserver

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI magriii,
how do you deploy updates: using a Deployment Server or an external tool.

If Deployment Server, remember to check the Splunkd restart checkbox in ServerClass.
If an external tool, remember to restart Splunk after updates.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...