Getting Data In

When making changes to .conf files in a distributed environment, how do I make sure changes get pushed to indexers and forwarders?

omuelle1
Communicator

HI,

I got a question about how to most efficiently change .conf settings in a distributed environment.

For example: I just made a change in my inputs.conf file for an app on my search head in the deployment apps folder. From what I remember, the indexers and forwarders should recognize that a change was made and pull the new file over. However, only the files are being changed on the forwarders, the indexers do not update the files. Any idea how to change that?

Oliver

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

In the scenario you are describing, there are a few points to clarify and understand...

1) If you put the app in the deployment-apps folder on the Search Head (SH), the SH takes on the role of a deployment server.
2) Your clients (forwarders) need to be connected to the deployment server and associated to the proper serverclasses.conf.
3) The indexer(s) need to have the same configuration and point to the deployment server. **** HOWEVER **** If you are using a clustered indexer, then you SHOULD NOT connect your indexers to the deployment server. This is not supported and can cause problems. ( http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Manageappdeployment)
4) If your indexers are "standalone", then it should work as you describe, check your deploymentclient.conf on your indexers. If your indexers are clustered, you need to distribute configs either manually or via master-apps on the Cluster Master node.

So depending on your environment, your answer has a couple different options.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

In the scenario you are describing, there are a few points to clarify and understand...

1) If you put the app in the deployment-apps folder on the Search Head (SH), the SH takes on the role of a deployment server.
2) Your clients (forwarders) need to be connected to the deployment server and associated to the proper serverclasses.conf.
3) The indexer(s) need to have the same configuration and point to the deployment server. **** HOWEVER **** If you are using a clustered indexer, then you SHOULD NOT connect your indexers to the deployment server. This is not supported and can cause problems. ( http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Manageappdeployment)
4) If your indexers are "standalone", then it should work as you describe, check your deploymentclient.conf on your indexers. If your indexers are clustered, you need to distribute configs either manually or via master-apps on the Cluster Master node.

So depending on your environment, your answer has a couple different options.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...