All Apps and Add-ons

Does uninstalling an app or add-on via the deployment server not trigger the "restartIfNeeded" flag in serverclass.conf?

gjanders
SplunkTrust
SplunkTrust

I started using this flag within the serverclass.conf of our deployment server as document here

restartIfNeeded = true | false
* This is only valid on forwarders that are newer than 6.4.
* If true and issueReload is also true, then when an updated app is delpoyed
  to the client, that client will try to reload that app. If it fails, it will
  then restart.
* defaults to false

This flag appears to work fine for my purposes, at least most of the time.
However I've hit an edge case where we removed a few servers from the list and therefore the uninstall was triggered for the TA-nmon - Technical Addon for Nmon Performance Monitor add-on. However the issue was that post uninstallation the universal forwarder continued to attempt to run the scheduled execution of a script every minute (which failed because the application was deleted).

The issue isn't major but was a little bit annoying, a restart of the universal forwarder resolved the issue.

Is this expected with this flag? Or in general? Does uninstalling an application via a deployment server not trigger a restart if needed?

1 Solution

gjanders
SplunkTrust
SplunkTrust

At the time of writing I'm running Splunk 6.5.2 on the deployment server & universal forwarder in question.

Splunk have logged this as an enhancement request now.

Splunk have advised to use the restart option in the serverclass if you want to prevent the errors relating to the scheduled execution of a script appearing post-uninstallation of an application from the deployment server...

View solution in original post

0 Karma

gjanders
SplunkTrust
SplunkTrust

At the time of writing I'm running Splunk 6.5.2 on the deployment server & universal forwarder in question.

Splunk have logged this as an enhancement request now.

Splunk have advised to use the restart option in the serverclass if you want to prevent the errors relating to the scheduled execution of a script appearing post-uninstallation of an application from the deployment server...

0 Karma

gjanders
SplunkTrust
SplunkTrust

Splunk have logged this as an enhancement request now.

Splunk have advised to use the restart option in the serverclass if you want to prevent the errors relating to the scheduled execution of a script appearing post-uninstallation of an application from the deployment server...

0 Karma

xpac
SplunkTrust
SplunkTrust

@gjanders: Did you ever get an update on that enhancement request?

0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma

woodcock
Esteemed Legend

I would definitely open a support case.

0 Karma

gjanders
SplunkTrust
SplunkTrust

I have so many cases open that I'm trying to avoid creating more 🙂
If I don't see a good answer I will resort to a support case.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...