topic Re: Can I reload savedsearches.conf without restarting? in Deployment Architecture

Can I reload savedsearches.conf without restarting?

echalex — Tue, 09 Oct 2012 11:28:31 GMT

Hi,

Since, I'm runnning into problems with concurrent historical searches approaching the limit, I decided to heed the advice of rescheduling them not to run on top of the hour every hour.

Since there are a lot of those, I prefer to do it in the shell:

cd etc/apps/webintelligence
egrep '^(cron.*|\[.*\])$' default/savedsearches.conf  | \
egrep -B 1 'cron_schedule = 0(\ \*){4}' | \ 
perl -pe 's/0((?:\ \*){4})/3$1\n/g' > local/savedsearches.conf

What this does, is take every stanza with a cron_schedule of 0 * * * * and turn it into 3 * * * *, ie. running it 3 minutes after the hour.

Unfortunately, Splunk doesn't recognise this change. (and I've tried |extract reload=T). If I click on each saved search, it will show the correct schedule, but under the "Searches and reports", it is still scheduled to run at 15:00, rather than 15:03.

So can I reload this configuration without restarting Splunk?

Re: Can I reload savedsearches.conf without restarting?

Ayn — Tue, 09 Oct 2012 11:46:06 GMT

Yes. Hitting the /debug/refresh endpoint should activate these changes.

http(s)://yoursplunkhost:8000/debug/refresh

Re: Can I reload savedsearches.conf without restarting?

echalex — Tue, 09 Oct 2012 12:01:40 GMT

Thanks,

It does not seem to work... Does it matter that that I get a 404 error from that url?

Re: Can I reload savedsearches.conf without restarting?

Ayn — Tue, 09 Oct 2012 12:16:40 GMT

Sorry, my bad - the link should point to the regular Splunk web interface, not the splunkd port. Updated my answer with the correct link.

Re: Can I reload savedsearches.conf without restarting?

echalex — Tue, 09 Oct 2012 12:28:12 GMT

I still can't see the changes. It does seem that the new schedule enters into force after the next scheduled run, in any case.

Should it work for all apps?

Re: Can I reload savedsearches.conf without restarting?

Ayn — Tue, 09 Oct 2012 12:50:39 GMT

I imagine this will not have effect on events that have already entered the scheduler.

Re: Can I reload savedsearches.conf without restarting?

echalex — Tue, 09 Oct 2012 12:51:59 GMT

Ok, that does explain it.
Thanks for your help!

Re: Can I reload savedsearches.conf without restarting?

gfrjonp — Mon, 28 Sep 2020 12:46:20 GMT

Check this out:
http://splunk-base.splunk.com/answers/5838/can-inputsconf-be-reloaded-without-restarting-splunkd?page=1&focusedAnswerId=8455#8455

cd /opt/splunk/bin (or your $SPLUNK_BASE)
./splunk _internal call /services/data/inputs/monitor/_reload -auth

This will prompt you for username & pass of a web admin user.

Re: Can I reload savedsearches.conf without restarting?

splunk68 — Fri, 17 May 2013 13:20:30 GMT

It worked for me, on Splunk Search Head 5.0.2.

Re: Can I reload savedsearches.conf without restarting?

dougmartin — Thu, 23 Jun 2016 13:51:03 GMT

You can access specific reloads like this:
https://spliunk:8080/en-US/debug/refresh?entity=admin/savedsearch