Deployment Architecture

Find changes that require a restart of Splunk?

BenjaminWyatt
Communicator

I logged into Splunk today, and got the dreaded "Splunk must be restarted for changes to take effect" message. The thing is, neither I nor anyone on my team made any changes that require a restart. So now I'm combing through the logs, trying to figure out what the change was that Splunk is complaining about, but I'm having trouble determining where to look - I've mainly been looking at _audit events, but I'm not finding anything there. How do you all go about finding these sorts of changes?

lukejadamec
Super Champion

Try looking in the _internal index, and search for "*restart*", or "*required a restart*".

I don't think you will see what you're looking for in _audit.

0 Karma

lukejadamec
Super Champion

If Splunk did not log an event that would require a restart, then once you find it you should submit a bug report.
If it is not in the splunk log, then I recommend searching the Splunk directory for file system changes that night.
You can also search the system's logs for activity pertaining to "*splunk*" over that timeframe.

0 Karma

BenjaminWyatt
Communicator

I did a search for LocalAppsAdminHandler and didn't see anything.

Yes, that's the message I'm seeing when users see the banner.

0 Karma

lukejadamec
Super Champion

Chances are you are looking for a single message.

Try searching for LocalAppsAdminHandler.
Is the message you're seeing "GET /services/messages/restart_required"?

0 Karma

BenjaminWyatt
Communicator

I looked at that, but it appears the only events I find with "restart" are logs associated with users seeing the "requires a restart" message - not with the event that caused the need for a restart. Any other ideas where it might be hiding?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...