Forwarder outputs.conf checking DSN updates

[jeffbat]

Does anyone know the amount of time a universal forwarder takes to go and recheck the DNS entries of servers listed in the outputs.conf file.

If the servers are listed by servername and not IP in the outputs file than Splunk would go out and check for the IP of those servers.  I know it does this at forwarder startup; but doe it also recheck periodically?  

I am looking at a situation where the DNS entries for the backend servers get changed to new IPs (in a disaster recovery scenario) and want to know how long it would take the forwarders to start picking up on the new IPs (without having to go out and cycle the all of the forwarders that would talk to the indexers whose IPs got changed).

Thanks.

[PickleRick]

I don't know but I'll tell you how I'd check it. I'd run the forwarder with strace and check if it calls gethostbyname() on startup only or on each connection try..