I know this question is older but I will try to answer it since I hit on it an think maybe the answer is interesting for the 765 guys that have seen this question till now and the ones that will see this question. By default Splunk will only open up to 100 file descriptors for reading logs (limits.conf : max_fd). So if you define time_before_close and monitor more than the limit of file descriptors splunk first has to wait until a file discriptor becomes free before it can start reading the next file. So if you have many monitored files splunk will imediatly start reading the first 100 files, wait time_before_close (in your case 5mins) and after that starts reading the next 100 files ... ... View more

I did a few checks on a deployed App 1) Just touched an file within the App Directory >> App was not updated even if I do a splunk reload deploy-serer 2) Changed GUI visibility within app.conf & transforms.conf >> App was not updated even if I do a splunk reload deploy-server 3) Restarted the Client so that changes >> App was not updated even if I do a splunk reload deploy-server So no, in my Environment I do not see the expected behavior. ... View more

I guess this is to aggressive. Imagie whathappens if an App forces Splunk to restart after it is installed ... ... View more

You could use a dirty hack: Add a scripted input to your app on the old deployment server and miss use the input script to remove the old deploymentserver config from etc/system/local in case it exists. Deploy this app down to your clients and all clients should now remove the config from etc/system/local and have a new config within your app. However you then need to restart the clients to get the new config active e.g. by removing the scripted input on the deployment server, setting restartSplunkd = true and deploying the app again. Additionally you should also place your configuration app (without the scripted input) on the new deployment Server. Probably not the best way but a way you could potentially go if you have no other chances. But you should first carefully check with a single test client! ... View more