I'm trying to get Splunk to reload the deployment server when we have updated our apps without having to manually go onto the box.
Basically we run a jenkins job that builds a version of our apps. It then ssh onto the deployment server and puts them into the /etc/deployment-apps folder. This all works but I can't get it to reload the apps using deploy-reload as it prompts for a username. I've tried to use -auth and pass in the credentials via an environment variable but it doesn't work. I've also created a script to do an expect when it prompts for the Splunk username: but can't get this to work either.
Has anyone got any ideas how we can implement this?
REST call:
curl -ku admin:your_password https://your_splunk_server:8089/servicesNS/-/system/deployment/server/config/_reload
Problem is putting them in the deployment-apps folder doesn't add them to serverclasses.conf so new apps aren't going to auto deploy. If you're effectively just adding new inputs and props stanzas then the API approaches mentioned in the answers work well.
Use the URL below, substituting your host name for myHostName and the serverClass you want to reload for serverClassName
https://myHostName:8089/services/deployment/server/serverclasses/serverClassName/reload
REST call:
curl -ku admin:your_password https://your_splunk_server:8089/servicesNS/-/system/deployment/server/config/_reload
Brilliant thanks, tried both approaches and both work
I assume this one would reload all serverClasses.
Yes, all server classes would reload with that endpoint
We are running Splunk 6.3.1 on our deployment servers. I have a script that does reload /opt/splunk/bin/splunk reload deploy-server -auth myadminuser:password and that works for us. I just tested. If I leave the -auth off it prompts. If I include it I can see that server is reloaded with changes that I made.
The reload operation doens't support passing the credentials from CLI. How frequently do you do the build which requires a deployment server reload? If it's not too frequent, you can push the changes by restarting the deployment server.
The Splunk restart would refresh all endpoints, including deploy-server and will push (or make available) all the changes made to the deployment-clients
Currently we are constantly pushing changes as more teams on-board with different log formats. It tends to be the inputs.conf and props.conf that are the only things changing.
Is splunk clever enough to know that a change has been made to an app after the restart and push it out based on what's defined in the serverclass file for the app?