topic props.conf changes require complete restart? in Getting Data In

props.conf changes require complete restart?

FRoth — Wed, 18 May 2011 21:52:27 GMT

Hi to all - short question:

Do changes to the props.conf really require a restart of splunk?
Is there a way to apply the changes without restarting?

Re: props.conf changes require complete restart?

jbsplunk — Wed, 18 May 2011 22:32:52 GMT

Yes. Per the documentation:

http://www.splunk.com/base/Documentation/latest/admin/Propsconf

To use one or more of these configurations, copy the configuration block into
props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.

Re: props.conf changes require complete restart?

Masa — Thu, 19 May 2011 07:28:01 GMT

Most of the case, Yes.

However, Search time field extraction via props.conf, (and transforms.conf) does not require restarting Splunk.

Re: props.conf changes require complete restart?

markmcd — Wed, 01 May 2013 11:59:25 GMT

+1 to @Masa. This applies to props.conf changes in the user scope (e.g. etc/users/myusername/search/local/props.conf)