I am preparing to upgrade numerous apps and add-ons. I will be using deployment server for all changes. The changes will affect searchheads, indexers, and forwarders. How do I determine if the target nodes need reboot after a change is applied?
Hi tsheets13,
at first, as suggested by @somesoni2, read Splunk docs.
Anyway, to be sure, you can force a restart on Universal Forwarders with no problems.
About Search Heads and Indexers, I think that you haven't clusters!
So i don't like to use Deployment Server for these kind of systems because I cannot control Splunk restart, so i prefer to do this manually.
Bye.
Giuseppe
I do have a multisite cluster.
Make sure you are using the Master Node for Index Clusters and the Deployer for Search Head Clusters.
The need for a Splunk restart on SH and Indexers is actually determined by the app getting deployed. Splunk UI should provide a message to notify if a restart is required.
if you have a multisite cluster, you cannot use DS to update Indexers, eventually, it's also possible to use DS to update Master Node that deploys upgrades to Indexers
Anyway, for Forwarders, reboot isn't a problem.
For Search Heads, if you have a cluster, you can manually upgrade Apps on Deployer or use DS to upgrade the Deployer that will upgrade SHs.
Bye.
Giuseppe
This might be a good read: https://docs.splunk.com/Documentation/AddOns/released/Overview/Installingadd-ons