When a forwarder phones home to a Deployment Server it compares the check-sum value of the forwarder’s app to the Deployment Server’s app. What happens to the app if the check-sum values do not match?
A.
The app on the forwarder is always deleted and re-downloaded from the Deployment Server.
B.
The app on the forwarder is only deleted and re-downloaded from the Deployment Server if the forwarder’s app has a smaller check-sum value.
C.
The app is downloaded from the Deployment Server and the changes are merged.
D.
A warning is generated on the Deployment Server stating the apps are out of sync. An Admin will need to confirm which version of the app should be used.
The correct answer is: ✅ **A. The app on the forwarder is always deleted and re-downloaded from the Deployment Server.
Explanation:
When a **Universal Forwarder** "phones home" to a **Deployment Server**:
* It compares the **checksum** of its locally installed app with the version on the Deployment Server.
* If the checksums **do not match**, Splunk assumes the app has changed.
* The **forwarder deletes the existing app** and **downloads the complete app** from the Deployment Server.
There is **no merging** of changes and no manual confirmation required — this process is automatic to ensure consistency.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
2dd1c50
1 day, 11 hours ago