All Apps and Add-ons

Does changing a server time break the deployment monitor?

andrewfoglesong
Explorer

I've set a server running a Universal Forwarder to a time in the future. Would this confuse a Deployment Monitor running on my search head to thinking the UF is "missing" and that it's last checking time was when the time was unmodified?

0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

It depends. At first, I think it would. However, assuming it remains up and the indexer(s) eventually "catch up" to the forwarder's time, it would not note it as missing. In either case, deployment monitor would not be able to provide accurate results for the forwarder in question.

View solution in original post

andrewfoglesong
Explorer

So I was changing the server time to test another component and couldn't tell if it was the other component that was breaking the DepMon or the time difference. I found an alternative way to test the other component and sure enough, DepMon sees it as active and sending data every minute or so. So ajaitz is right, moving the time into the future on a server hosting a UF will break the communication. It both stopped indexing and wasn't reporting in. Changed the time back, and it picked right back from where it left off. Thank goodness it was reversible!

0 Karma

araitz
Splunk Employee
Splunk Employee

It depends. At first, I think it would. However, assuming it remains up and the indexer(s) eventually "catch up" to the forwarder's time, it would not note it as missing. In either case, deployment monitor would not be able to provide accurate results for the forwarder in question.

andrewfoglesong
Explorer

Thanks. I'll do some more testing but that makes senes to me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...