Splunk Enterprise

Splunk Forwarder Restart Requirements when Deployed Apps are updated

shocko
Contributor

I'm using Splunk Enterprise 9.x  with Universal Forwarders 9.x on Windows 2019. All my forwarders are connected to a deployment server. I notice the following for example:

  1. I update a deployment server app (say update inputs.conf with a new input stanza)
  2. I restart the deployment server
  3. I view the inputs at the forwarder using btool and see that my changes have propagated

However, even though the updated inputs.conf file seems to have landed at the forwarder I do not see the events defined by my new inputs.conf hitting the indexer until I restart the forwarder. Perhaps this is expected based on this When to restart Splunk Enterprise after a configuration file change - Splunk Documentation ?

Is this expected and if so is there any way to restart the forwarder remotely using Splunk itself? 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Any app containing inputs.conf should have the "Restart splunkd" option enabled.  Do that in the Forwarder Management section of the Deployment Server.  That will tell the UF to restart itself each time it gets an updated copy of the app.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Any app containing inputs.conf should have the "Restart splunkd" option enabled.  Do that in the Forwarder Management section of the Deployment Server.  That will tell the UF to restart itself each time it gets an updated copy of the app.

---
If this reply helps you, Karma would be appreciated.

shocko
Contributor

I assumed (rather embarrassingly!) this restarted the deployment server splunkd! This is very useful. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
It’s not restarting Splunkd, it just reload deployment server DS related configurations. For that reason it’s much faster than restarting splunkd.
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

just like @richgalloway said. One comment about your "restart ds". It's not needed to restart it, just reload it's configuration for deployment part with command 

splunk reload deploy-server

Or even add more granularity there it you have lot of configurations and restart or even base reload take too long.

r. Ismo 

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...