Where can I find update interval for Universal Forwarder

[Alberto_Astolf1]

Dear all,
could you please tell me how often the Universal Forwarder checks for and downloads the configuration file from the deployment server?

Could you please tell me how to check the Universal Forwarder log files to locate the string that reports this update operation?

Thanks

[Alberto_Astolf1 · Accepted solution]

Ok, I found it by myself.

I have to launch

./splunk reload deploy-server

to redeploy the changes.

As described here: Deploy apps to agents | Splunk Enterprise (last updated 2026-01-08T08:11:35.895Z)

Bye

[PickleRick]

https://community.splunk.com/t5/Monitoring-Splunk/Where-can-I-find-update-interval-for-Universal-For... 😛

[gcusello]

Hi @Alberto_Astolf1 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

P.S.: Sign in to the Splunk Italia User group: https://usergroups.splunk.com/italia-splunk-user-group/

[Alberto_Astolf1]

Hi @PickleRick ,
what do you means by "use capabilities"?

I decided to run the UF as root, because there are many, many log files to read by UF, and with many different owners, groups, and permissions. It would require a truly enormous effort to change the various permissions, groups, and users. The easy way is to run the UF as root.

However, I don't think this impacted the UF update.

I think that the root cause of my issue is that the DS doesn't recognize that the deployment app file was changed.

Ciao
Alberto

[isoutamo]

With the latest splunk version it’s denied to run it as a root! You must use that way what @PickleRick already showed to you.
If UF load the new package from DS, but didn’t take it into use, it quite obvious that your configuration missed restart UF parameter on serverclass configuration file.

[PickleRick]

Of course. It has nothing to do with communication to DS but it's a good practice to use least privileged user.

See

https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/universal-forwarder-manual...

(for older UF versions you had to grant splunkd the CAP_DAC_READ_SEARCH manually, with modern releases I think it's by default when you enable boot-start using systemd)

[kknairr]

@Alberto_Astolf1 - By default, the Universal forwarder (UF) contacts the Deployment server every 60 seconds to check for & download updated configurations, also known as phone home interval in splunk terms. You can verify the interval part from deploymentclient.conf under the "phoneHomeIntervalInSecs" parameter.

On your second question, to verify the phoning activity in UF side, you should check the splunkd.log file located under $SPLUNK_HOME/var/log/splunk/ location. The deployment client writes messages tagged with DC:DeploymentClient whenever it connects to the Deployment Server, checks for updates, or downloads new configurations. Searching this log for keywords like phoneHome, DeploymentClient etc will show the exact timestamps of each check-in and update operation. 

For additional confirmation, you can run $SPLUNK_HOME/bin/splunk btool deploymentclient list --debug to display the effective configuration on the UFs and confirm the current interval setting.

Hope this helps.

>>

If this post addressed your question, you can:

• Give it karma to show appreciation 👍
• Mark it as the solution if it solved your issue ✔️
• Add a comment if you’d like more details  ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

>>

[Alberto_Astolf1]

Thank you @kknairr 

It seems to not work as expected, because I have the issue I reported in the other reply.

[kknairr]

@Alberto_Astolf1 Okay, couple of things which might be worth checking in that case.

• Make sure the modified inputs.conf  is in the correct directory (local vs default) within the app. Misplaced files can prevent the DS from packaging them correctly.
• Confirm that the forwarders not reflecting updates are still members of the intended server class. If they’re not, they won’t receive the updated app.
• Check the logs in $SPLUNK_HOME/var/log/splunk/splunkd.log on the DS for DeploymentServer activity to confirm it registered the app change and attempted distribution.
• On the UF side, look in splunkd.log for deployment entries. If you see regular phone‑home messages but no app update, that suggests the DS didn’t flag the app as changed.

If you're unable to figure out still, highly recommend raising a support case with the Splunk support by providing them related log files for effective troubleshooting.

>>

If this post addressed your question, you can:

• Give it karma to show appreciation 👍
• Mark it as the solution if it solved your issue ✔️
• Add a comment if you’d like more details ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

>>

[PickleRick]

deploymentclient.conf is the configuration file responsible for... well, the deployment client settings. It contains (among other things) the DS address as well as the interval with which the DC (in your case - the UF) calls home.

Of course because of the usual layering of configuration files from various places (see https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.1/administer-splunk-enterpris... ) you can get the effective configuration (along with the source of each entry) with

splunk btool deploymentclient list --debug

[gcusello]

Hi @Alberto_Astolf1 ,

in the file deploymentclient.conf, you can find all the configurations of the connection between the client and the Deployment Server, for more infos see at https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/configuration-file-referenc...

Anyway:

phoneHomeIntervalInSecs = <decimal>
* How frequently, in seconds, this deployment client should
  check for new content.
* Fractional seconds are allowed.
* Default: 60.

At least, you can find connection information on the _dsclient index.

What's your issue?

Ciao.

Giuseppe

[Alberto_Astolf1]

Hi @gcusello ,
the issue is the following.
I have one app that is distributed to various UF through a specific Server Class.
This app have the input.conf file that I modified (I added more monitor sections).
This app is here from several weeks, and I just changed it.
This change is not propagated to the UF.
I didn't modified the update interval, so I'm expecting that after 60 seconds the UF have the new input.conf file.

Thanks

[gcusello]

Hi @Alberto_Astolf1 ,

let me understand: was the app not deployed to the client or was it deployed but it doesn't run?

in the second case, did you remember to add the restart of splunkd on the UF?

Anyway, if you have many clients, each one has to wait for more than 60 seconds.

Ciao.

Giuseppe

[Alberto_Astolf1]

Hi @gcusello ,
the app has been here for a few weeks. It was deployed correctly. 

Today I made some changes to the input.conf file within the app.

However, these changes are not reported in the UF.

Ciao,
Alberto

[gcusello]

Hi @Alberto_Astolf1 ,

checking in the DS, do you see that apps are all deployed to the client?

please manually check if the updates are present on the UF and try to manually restart the UF.

Are you speaking of w Windows or Linux DS and Client?

Ciao.

Giuseppe

[Alberto_Astolf1]

Hi @gcusello ,
yes, from the DS web UI I see that the app is successfully deployed. I also see that "Last load time" is the Mar 13. 

In the UF system, I see the app in the ./etc/apps/<appname> location.

It seems that the DS doesn't recognize that I modified the app.

The DS and the UF are both on a Linux. I modified the app directly editing the files inside the ./etc/deployment-apps/<appname>/local/ directory. 

Ciao,
Alberto

[PickleRick]

Wait a second. You edited the app on DS in etc/deployment-apps but did you do

splunk reload deploy-server

[gcusello]

Hi @Alberto_Astolf1 ,

Did you directly checked if the add-on was updated on the client?

did you tried to restart Splunk on the UF?

what's the owner of the files in ./etc/apps/<appname> location ?

Ciao.

Giuseppe

[Alberto_Astolf1]

Hi @gcusello ,

the app is not updating on the client (this is the main issue that I'm facing).

Ideally, I would like the changes to be propagated automatically so that I don't have to restart the UF manually every time I make changes.

All files are owned by root, and UF also runs as root.

Ciao,
Alberto

[gcusello]

Hi @Alberto_Astolf1 ,

it isn't a best practice to run Splunk as root for security reasons.

Anyway, as I said, remember to setup splunkd retart for your app.

Only for test, try to restart Splunk on your UF to see if that is the issue.

Ciao.

Giuseppe