Reboots required after app/add-on update

[tsheets13]

I am preparing to upgrade numerous apps and add-ons. I will be using deployment server for all changes. The changes will affect searchheads, indexers, and forwarders. How do I determine if the target nodes need reboot after a change is applied?

[gcusello]

Hi tsheets13,
at first, as suggested by @somesoni2, read Splunk docs.

Anyway, to be sure, you can force a restart on Universal Forwarders with no problems.
About Search Heads and Indexers, I think that you haven't clusters!
So i don't like to use Deployment Server for these kind of systems because I cannot control Splunk restart, so i prefer to do this manually.

Bye.
Giuseppe

[tsheets13]

I do have a multisite cluster.

[sloshburch]

Make sure you are using the Master Node for Index Clusters and the Deployer for Search Head Clusters.

The need for a Splunk restart on SH and Indexers is actually determined by the app getting deployed. Splunk UI should provide a message to notify if a restart is required.

[gcusello]

if you have a multisite cluster, you cannot use DS to update Indexers, eventually, it's also possible to use DS to update Master Node that deploys upgrades to Indexers
Anyway, for Forwarders, reboot isn't a problem.
For Search Heads, if you have a cluster, you can manually upgrade Apps on Deployer or use DS to upgrade the Deployer that will upgrade SHs.

Bye.
Giuseppe

[somesoni2]

This might be a good read: https://docs.splunk.com/Documentation/AddOns/released/Overview/Installingadd-ons