Getting Data In

Why is the deployment server not pushing updated inputs.conf configurations to forwarders automatically?

anoopambli
Communicator

I updated inputs.conf on an app in the deployment server yesterday. The update was done by logging into the server and editing the file. I checked the forwarders today and they didn't receive the updated inputs. I went to the GUI of deployment server and edited the server class; removed a server from the list and saved server class and that pushed the updated config to all forwarders. Is that an expected behavior?

Doesn't the deployment server automatically send the updated config to its forwarders? or do we need to force it after a change?

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you update a .conf file in a deployment app you need to run this CLI command to tell Splunk to send it to the deployment clients:

./bin/splunk reload deploy-server

That will reload all serverclasses and send them any updates it finds. Optionally you can pass a severclass argument to only reload a specific serverclass, avoiding any unfinished changes being sent out to other serverclasses.

Your change in the forwarder management UI implicitly triggered a reload of that serverclass, so it is indeed expected behaviour that Splunk sent the change then - but it's not the best way to trigger that reload at all.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you update a .conf file in a deployment app you need to run this CLI command to tell Splunk to send it to the deployment clients:

./bin/splunk reload deploy-server

That will reload all serverclasses and send them any updates it finds. Optionally you can pass a severclass argument to only reload a specific serverclass, avoiding any unfinished changes being sent out to other serverclasses.

Your change in the forwarder management UI implicitly triggered a reload of that serverclass, so it is indeed expected behaviour that Splunk sent the change then - but it's not the best way to trigger that reload at all.

martin_mueller
SplunkTrust
SplunkTrust

Run this command:

./bin/splunk help reload deploy-server

You'll get this output:

Reload you deployment server, in entirety or by serverclass

Syntax:
    reload deploy-server [-class <serverclass_name>]

Objects:
    reload deploy-server                    Reload you deployment server, in entirety or by serverclass

Required Parameters:
    None

Optional Parameters:
    (For reload deploy-server)
            class                           serverclass to be reloaded.

Examples:
    ./splunk reload deploy-server
    ./splunk reload deploy-server -class my_serverclass
0 Karma

anoopambli
Communicator

Thank you very much, that explains It well.

0 Karma

anoopambli
Communicator

Martin, how do we pass serverclass argument to the command. I tried looking for it but didnt find any.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...