I updated inputs.conf on an app in the deployment server yesterday. The update was done by logging into the server and editing the file. I checked the forwarders today and they didn't receive the updated inputs. I went to the GUI of deployment server and edited the server class; removed a server from the list and saved server class and that pushed the updated config to all forwarders. Is that an expected behavior?
Doesn't the deployment server automatically send the updated config to its forwarders? or do we need to force it after a change?
If you update a .conf file in a deployment app you need to run this CLI command to tell Splunk to send it to the deployment clients:
./bin/splunk reload deploy-server
That will reload all serverclasses and send them any updates it finds. Optionally you can pass a severclass argument to only reload a specific serverclass, avoiding any unfinished changes being sent out to other serverclasses.
Your change in the forwarder management UI implicitly triggered a reload of that serverclass, so it is indeed expected behaviour that Splunk sent the change then - but it's not the best way to trigger that reload at all.
Martin, how do we pass serverclass argument to the command. I tried looking for it but didnt find any.
Run this command:
./bin/splunk help reload deploy-server
You'll get this output:
Reload you deployment server, in entirety or by serverclass Syntax: reload deploy-server [-class <serverclass_name>] Objects: reload deploy-server Reload you deployment server, in entirety or by serverclass Required Parameters: None Optional Parameters: (For reload deploy-server) class serverclass to be reloaded. Examples: ./splunk reload deploy-server ./splunk reload deploy-server -class my_serverclass