topic Installation of Splunk again and again. in Deployment Architecture

Installation of Splunk again and again.

msona — Fri, 18 Feb 2011 18:43:51 GMT

Dear All,

I am new to Splunk, So while doing changes in input.conf or props.conf etc. the changes are not taking place unless and untill. I reinstall the splunk. Is there any other method ?

Your help is appreciated..

Re: Installation of Splunk again and again.

vaijpc — Fri, 18 Feb 2011 19:10:40 GMT

Have you tried just restarting splunk?

$SPLUNK_HOME$/bin> splunk resart

Re: Installation of Splunk again and again.

rotten — Fri, 18 Feb 2011 23:43:36 GMT

You can pull in changes to props.conf with the not-so-intuitive search command (as admin):

* | extract reload=true

I think you only need to search a short time-window (like 5 minutes) for this to cause props.conf to be reloaded.

Re: Installation of Splunk again and again.

gkanapathy — Sat, 19 Feb 2011 01:40:56 GMT

You mean restart, not reinstall, right?

Re: Installation of Splunk again and again.

msona — Mon, 21 Feb 2011 10:13:07 GMT

yes, tried but not working.
I think the problem is, splunk already index the fields and can not delete the indexed data, if I change somthing input.conf or props.conf

Re: Installation of Splunk again and again.

msona — Mon, 21 Feb 2011 10:40:09 GMT

its short time data like 1 day. But Can splunk changes the data which was already indexed before ?? after changes in props.conf.
For example: Splunk taking some unnesessary field values from csv header. I wanna remove that. I am doing changes in conf files but changes taking place after reinstall the splunk.

Re: Installation of Splunk again and again.

Hajime — Mon, 21 Feb 2011 15:42:10 GMT

Hello. How about it? (using CLI)

Stop Splunk:

./splunk stop

Remove unnecessary data from indexes: (This example removes all data from all indexes.)

./splunk clean all -f

Restart Splunk:

./splunk restart

Re: Installation of Splunk again and again.

rotten — Mon, 21 Feb 2011 21:39:31 GMT

Once the data is indexed it is written in stone. Re-reading the props.conf applies to future events.

Re: Installation of Splunk again and again.

msona — Tue, 22 Feb 2011 15:15:45 GMT

Thank you very much

Re: Installation of Splunk again and again.

lguinn2 — Fri, 20 May 2011 19:18:26 GMT

As "rotten" mentioned, once the data has been indexed, it cannot be changed. However, some things are not stored in the index. Those things can be changed as you wish. Below are the basics; look in the documentation for more details.

Changes to inputs.conf change how all new data will be indexed. These changes do not affect data that has already been indexed. If you want these changes to apply to all data, you will need to use the splunk clean command, as was shown in one of the other answers.

Changes to props.conf may change how data is indexed:

Setting the source, sourcetype or host - these affect how the data is indexed. Therefore, this is the same as changes to inputs.conf.
Defining field extractions - field definitions are not indexed; fields are built during the search process. These changes do not require that you restart Splunk. Any changes that you make to field extractions will apply to all data, regardless of when it was indexed. (BTW, you can do "index time field extractions" but don't. Use the normal, search-time field extractions - this is what Splunk recommends.)

If you are new to Splunk, I suggest that you use the web interface (the Splunk Manager) to set up your inputs, and the interactive field extractor to set up your fields. One of the nice things about using the Splunk web interface is that it will tell you if you need to restart Splunk.