topic Re: Create new index without restarting Splunk indexer? in Getting Data In

Create new index without restarting Splunk indexer?

the_wolverine — Mon, 22 Jul 2013 19:24:32 GMT

I understand that in the year 2013 it may be possible to create a new index without having to restart the indexer? If so which version and how?

Re: Create new index without restarting Splunk indexer?

grijhwani — Tue, 23 Jul 2013 00:17:55 GMT

You can if you perform the task through the GUI.

Re: Create new index without restarting Splunk indexer?

Linegod — Tue, 23 Jul 2013 15:17:48 GMT

CLI Admin Commands

"reload index" - reloads index configuration, making immediately effective all "add/edit/enable/disable index" commands since last reload or Splunk restart

# /opt/splunk/bin/splunk reload index
# Index config reloaded.

# /opt/splunk/bin/splunk reload index -name {index_name}

Re: Create new index without restarting Splunk indexer?

sowings — Tue, 23 Jul 2013 16:14:21 GMT

You can also do so via the REST API. You'll want something like curl:

curl -k -u <USER>:<PASS> https://indexer:port/servicesNS/<user>/<app\_to\_save\_settings>/data/indexes -d name=<newindex>

Populated example:

curl -k -u admin:changeme https://127.0.0.1:8089/servicesNS/admin/search/data/indexes -d name=mytest

Check the REST API Endpoint docs; you can adjust specific parameters of the index definition at creation time as well, with additional -d options.

http://docs.splunk.com/Documentation/Splunk/5.0.3/RESTAPI/RESTlist

This has the additional benefit of being able to be scripted remotely, looping over all of the indexers in your environment.

Re: Create new index without restarting Splunk indexer?

sowings — Tue, 23 Jul 2013 16:14:56 GMT

Available from 4.3.x forward. I'm not sure about the specifics of ".x".

Re: Create new index without restarting Splunk indexer?

the_wolverine — Tue, 23 Jul 2013 19:35:51 GMT

Thanks! Just what I was looking for.

Re: Create new index without restarting Splunk indexer?

the_wolverine — Mon, 05 Aug 2013 21:22:55 GMT

I have heard that there is some update bug when using "reload index" which results in an incomplete reload of the actual indexes.conf.

Re: Create new index without restarting Splunk indexer?

sloshburch — Thu, 02 Jan 2014 18:42:12 GMT

I think the -name part of the command is not used (at least it won't work in 5.0.2 but works when it is removed)
I have seen the same issue the_wolverine mentioned. I can reload my index config but it won't create the appropriate directories.

Re: Create new index without restarting Splunk indexer?

sloshburch — Thu, 02 Jan 2014 18:43:15 GMT

Another approach that I think I just got to work:

https://<hostname>:<splunkdport>/services/data/indexes/_reload

That allows you to stage your index in the appropriate app from the deployment server, but then implement without restart.

Re: Create new index without restarting Splunk indexer?

splunker12er — Thu, 17 Jul 2014 07:14:45 GMT

Thanks alot.

Re: Create new index without restarting Splunk indexer?

theunf — Wed, 13 Aug 2014 04:51:54 GMT

How about doing that on a Master cluster node so it´ll be deployed on indexers peer nodes ?
Any way of requesting this creation on the master-apps instead of local indexes ?

Re: Create new index without restarting Splunk indexer?

sloshburch — Fri, 15 Aug 2014 11:43:35 GMT

That's an interesting question given that reloading config on the master node forces restarts on the slaves. I don't have any ideas on this one right now.

Re: Create new index without restarting Splunk indexer?

sherm77 — Mon, 28 Mar 2016 19:19:30 GMT

I had to use this just a few minutes ago (v6.2.0) and it works without the -name parameter..

/opt/splunk/bin/splunk reload index {index_name}

Thanks, this is much easier than restarting the production indexer after hours.

Re: Create new index without restarting Splunk indexer?

ddrillic — Mon, 28 Mar 2016 21:31:38 GMT

If clustering is enabled, we can use /opt/splunk/bin/splunk apply cluster-bundle after adjusting indexes.conf.