Splunk Forwarder Restart Requirements when Deployed Apps are updated

[shocko]

I'm using Splunk Enterprise 9.x  with Universal Forwarders 9.x on Windows 2019. All my forwarders are connected to a deployment server. I notice the following for example:

1. I update a deployment server app (say update inputs.conf with a new input stanza)
2. I restart the deployment server
3. I view the inputs at the forwarder using btool and see that my changes have propagated

However, even though the updated inputs.conf file seems to have landed at the forwarder I do not see the events defined by my new inputs.conf hitting the indexer until I restart the forwarder. Perhaps this is expected based on this When to restart Splunk Enterprise after a configuration file change - Splunk Documentation ?

Is this expected and if so is there any way to restart the forwarder remotely using Splunk itself? 

[richgalloway · Accepted solution]

Any app containing inputs.conf should have the "Restart splunkd" option enabled.  Do that in the Forwarder Management section of the Deployment Server.  That will tell the UF to restart itself each time it gets an updated copy of the app.

[shocko]

I assumed (rather embarrassingly!) this restarted the deployment server splunkd! This is very useful. 

[isoutamo]

It’s not restarting Splunkd, it just reload deployment server DS related configurations. For that reason it’s much faster than restarting splunkd.

[isoutamo]

Hi

just like @richgalloway said. One comment about your "restart ds". It's not needed to restart it, just reload it's configuration for deployment part with command 

splunk reload deploy-server

Or even add more granularity there it you have lot of configurations and restart or even base reload take too long.

r. Ismo