Deployment Architecture

Is restartSplunkd required for changes to take effect?

echalex
Builder

Hi,
I'm using the deployment server to deploy, among other things, props.conf files to indexers.

I'm a bit concerned about the impact of indexing, so that's why I'm asking if I'm required to restart splunkd on the indexers for props.conf to be effective, especially if I have both indexers in one class.

0 Karma
1 Solution

tskinnerivsec
Contributor

This is a quote from the props.conf example file that ships with splunk:

"The following are example props.conf configurations. Configure properties for your data. # # To use one or more of these configurations, copy the configuration block into # props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations."

I think this may only apply to the props.conf in the system/local directory on the server. I use a deployment server and deploy apps to all of my splunk instances. I have not had any restart issues on indexers when deploying new apps so far.

View solution in original post

tskinnerivsec
Contributor

You can restart the indexers one by one when you make a change. When you assign the app that applies your settings to the indexers assign the app such that it doesn't restart splunkd. You can do this in the serverclass.conf by creating a server class for your indexers and setting restartSplunkd = false.

You can then create an app who's only job is to restart splunkd. That restart app is just an empty app. Then in the serverclass.conf file created a separate server class for each of your indexers with restartSplunkd = true. Then, when you deploy your apps to your indexers, splunkd won't restart until you assign the restart app to the individual indexer class. Once you are done with the restarts, unassign the restart app until next time.

The other saving grace you may have is that the splunk servers will check into the deployment servers at slightly different points of their checkin interval, so both indexers probably won't restart at the same time anyway.

0 Karma

tskinnerivsec
Contributor

This is a quote from the props.conf example file that ships with splunk:

"The following are example props.conf configurations. Configure properties for your data. # # To use one or more of these configurations, copy the configuration block into # props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations."

I think this may only apply to the props.conf in the system/local directory on the server. I use a deployment server and deploy apps to all of my splunk instances. I have not had any restart issues on indexers when deploying new apps so far.

sowings
Splunk Employee
Splunk Employee

It's been my experience that props.conf changes don't require restarts any longer. I've had to restart for changes to inputs.conf, outputs.conf and indexes.conf. Otherwise, it should "just work" when deploying these changes with the deployment server.

0 Karma

echalex
Builder

Thanks. This is probably the best information available. It's just that I would like to restart the indexers one-by-one (preferrably not at all). Of course, I can have one server class per indexer as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...