topic Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart? in Splunk Cloud Platform

Can I debug/refresh Splunk Cloud env. or manage Splunk Cloud change via ACS without a Splunkd restart?

pstein — Thu, 13 Apr 2023 18:39:45 GMT

Two part question:

1) If I complete an individually owned App upgrade to our Victoria environment through the use of "Install App From File" which changes a props.conf setting, can I run a "debug/refresh" to reload the Splunk Cloud configs?

2) Or, if I manage the App change through ACS CLI to edit_local_apps

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Config/RBAC

Upgrade app (Victoria)

PATCH

apps/victoria/{app}

edit_local_apps AND install_apps

will my change circumnavigate a restart of the environment, and reload the configs simply by the use of ACS CLI?

Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart?

mattymo — Thu, 13 Apr 2023 15:21:03 GMT

I don't believe you can run /debug/refresh in cloud, at least not how I tried it

https://stackname .splunkcloud.com/en-US/debug/refresh

That being said restarts aren't needed for much anymore these days. Are you certain you need to or is it habit?

can you achieve what you need with the _reload endpoint instead?

https://docs.splunk.com/Documentation/Splunk/9.0.4/RESTUM/RESTusing#Reload_endpoint

Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart?

pstein — Thu, 13 Apr 2023 18:08:50 GMT

Thanks, Mattymo. Knowing debug/reload helps.

As I dug into your link and followed the link string to investigate further about REST API call, in this case using CURL, I found this tidbit:
"As a Splunk Cloud Platform user, you are restricted to interacting with the search tier only with the REST API."
Appears like my hands are tied when trying to find a non-restart solution similar to "debug/reload" like we enjoy onPrem.

Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart?

mattymo — Thu, 13 Apr 2023 19:07:52 GMT

I wouldn't give up yet...we have a lot of behind the scenes logic that takes care of distributing your configs in cloud and reducing the need for restarts, and the _reload option is available in cloud...are you certain you need a refresh? Generally props, i dont believe should require them anymore...

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Admin/RollingRestart#Reload_or_restart_behavior_of_common_.conf_files

https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Configurationfilechangesthatrequirerestart#Index-time_settings

are you hitting some sort of issue or error?

I can always test your app in my stack if you want...

Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart?

pstein — Thu, 13 Apr 2023 19:24:31 GMT

No. At this point I'm not hitting a hurdle or error, but trying to do upfront work in determining whether there's a method of reloading without causing a restart after installing an App "from a file". We don't want an unexpected request for restart in order to complete the installation, and impact our customers uptime. But if challenged with a request to restart could turn to a 'reload' option.

In my immediate scenario, in our Victoria environment, I recently upgraded a self built app from v1.0.0 to version 1.0.1 during a maintenance window to fix an issue . The change was mostly correct, but now I need to tweak my App to pickup the correct timestamp, and my next available maintenance window is next Monday night. All I'm modifying is "MAX_TIMESTAMP_LOOKAHEAD" in props.conf from 50 to 100.
I've been instructed to find a possible method to run a reload after the upgrade instead of a possible restart.

If there isn't a way to 'reload' vs. 'restart' in the Cloud, that's ok. I just need to know so we can stay within our Maintenance Window.

Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart?

mattymo — Thu, 13 Apr 2023 19:41:58 GMT

I think it will just use reload. will try and replicate in my stack when i get the chance and let you know. Docs say it should just be a reload automagically for props/tranforms changes.

Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart?

pstein — Fri, 14 Apr 2023 13:51:56 GMT

Thought I would just check in to see if you had any luck attempting in your stack. Unfortunately, I don't have a lab Cloud stack to attempt this myself. I appreciate your help.

Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart?

mattymo — Fri, 14 Apr 2023 15:10:08 GMT

Not yet, sorry, will have to try next week.

Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart?

pstein — Mon, 17 Apr 2023 20:37:50 GMT

Found this very accurate list of reload/restart config changes, and when each will be enacted.

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Admin/RollingRestart?_ga=2.153172536.1431580724.1681740474-740348461.1680787322&_gl=1*ts9bxj*_ga*NzQwMzQ4NDYxLjE2ODA3ODczMjI.*_ga_5EPM2P39FV*MTY4MTc0Nzc2My4yMS4xLjE2ODE3NDk4MDUuOS4wLjA.#Restart_versus_reload_behavior_of_common_apps_and_.conf_files

I think this answers my own question and aligns with what you previously mentioned.

Thank you for your help, @mattymo

Re: Can I debug/refresh Splunk Cloud env. or Manage Splunk Cloud Change via ACS Without a Splunkd Restart?

mattymo — Mon, 17 Apr 2023 20:43:41 GMT

Yeah, I linked that in my original answer. Let us know when you try and how it goes!