Deploying a simple TA to indexers - rolling restart required?

[danielbb]

We want to add a TA (app) to our indexers at the path /opt/splunk/etc/master-apps by running the command /opt/splunk/bin/splunk apply cluster-bundle

My question is if we can deploy an indexer app without a restart of the indexer? The TA we want to deploy is an extension to the nix TA, and all it does is run some simple bash scripted inputs.

[PickleRick]

See here:

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Updatepeerconfigurations#Restart_or_reloa...

And here:

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Updatepeerconfigurations#Use_the_CLI_to_v...

[danielbb]

Thank you so much, one of our stanzas looks like the following -

[script://./bin/ulimit.sh]
interval = 27 5 * * *
source = scripted_input
sourcetype = virtualization:sanity:ulimit
index = os
disabled = false

Based on the link you provided, a reload should be fine. How would we run a "reload"?

inputs.conf	http	reload
inputs.conf	script	reload
inputs.conf	monitor	reload
inputs.conf	<modular_input>	reload
inputs.conf	batch	reload