topic Which apps need the restartSplunkd to be true? in Getting Data In

Which apps need the restartSplunkd to be true?

spl_aficionado — Wed, 25 Feb 2026 15:57:16 GMT

We recently realized that the restartSplunkd attribute is more effective when defined at the individual app level rather than the server class level. We are currently refactoring our serverclass.conf to assign this attribute to every app, but we want to be more surgical with our approach.

Could anyone clarify the logic behind which specific types of apps require a Splunk restart to take effect?
Specifically, we are looking for guidance on these scenarios:

Apps deployed to Universal Forwarders (UFs).
Heavy Forwarders (HFs).
Input apps (inputs.conf).
Parsing apps (props.conf and transforms.conf) deployed to Indexers
and more.

Re: Which apps need the restartSplunkd to be true?

gcusello — Wed, 25 Feb 2026 16:36:33 GMT

Hi @spl_aficionado ,

to avoid to not apply changes I usually configure restart for each application!

Even if I know that it shouldn't be the best approach, but I don't want to lose time,

Ciao.

Giuseppe

Re: Which apps need the restartSplunkd to be true?

PickleRick — Thu, 26 Feb 2026 10:05:46 GMT

As a rule of thumb, everything that affects ingestion (which means apps deploying inputs and index-time transforms) requires restart. For search-time settings it's usual enough to reload or debug/refresh.

As a side note - since settings affecting ingest pipeline require restart, you might consider splitting parsing from indexers (push data through HFs first so that indexers receive already parsed data). This adds complexity and hardware to your environment but lowers load on the indexers and limits demands to restart indexers.