Deployment Architecture

does splunk indexer restart reload changes made on splunk forwader

Isaias_Garcia
Path Finder

Hi-

I made some changes in inputs.conf in splunk forwarder of our several servers.Then I restarted the splunk indexer (splunk web) to reload the changes. But i noticed that the changes i made on splunk forwarders did not take effect.so i want to ask , does splunk indexer restart reload changes made on splunk forwader?Or i need to restart every splunk forwarder to reload the changes?please advise.

Tags (1)
0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

A restart of an indexer will not cause changes made on the forwarders to take effect. If changes are made on the forwarder, then the forwarder instance needs to be restarted.

Note that when using Splunk deployment server, you can put a directive in the configuration to have the forwarder automatically restart upon receiving a change.

See restartSplunkd in the following doc: http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Serverclassconf

lukejadamec
Super Champion

To manage multiple severs of the same type, you should use a deployment server. In the serverclass.conf of the deployment server, which typically resides on the indexer you should specify restartSplunkd = true | false as true.
This will force the forwarders to restart after the update to the input.

0 Karma

Isaias_Garcia
Path Finder

Cool! thanks sbrant for your prompt response. I reaaly appreciate it..so now i need to restart these 22 forwarders 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...