topic To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer? in Getting Data In

To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

Abilan1 — Mon, 06 Jul 2015 19:13:15 GMT

Hi ,

I wanted to modify access for a few users and also I want to modify the index. Can I make these changes from Search Head or I need to modify this from Indexer?

If I modify inputs.conf file, do I need to restart my index and search head?

Regards,
Abilan

Re: To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

aljohnson_splun — Mon, 06 Jul 2015 19:24:51 GMT

1.) Modifying access to indexes can be set on the search head. See steps 7 and 8 here.

2.) See this document for generalities about when to restart different parts of Splunk. It states:

When to restart Splunkd:
As a general rule, anything that modifies:

Settings and properties that affect indexers and indexing behavior
Settings and properties that affect users and roles.
Settings and properties that affect Splunk's core configuration.

There is a way to use reload too; but the docs state you should restart.
See these answers for more information.

Re: To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

Abilan1 — Mon, 06 Jul 2015 20:20:13 GMT

Thank you very much for your help!

Re: To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

Abilan1 — Mon, 06 Jul 2015 20:39:03 GMT

Hi Johnson,

if I want to modify the index itself, is it possible to do it from Search Head?

Re: To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

aljohnson_splun — Mon, 06 Jul 2015 21:19:57 GMT

What modifications do you want to make ?

There is lots of specific index management documentation here:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/HowSplunkstoresindexes#Buckets_and_Splunk_Enterprise_administration

Re: To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

Abilan1 — Tue, 07 Jul 2015 08:16:53 GMT

Hi,

I want to modify the index name. is it possible to do it from Search Head?

Re: To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

aljohnson_splun — Tue, 07 Jul 2015 16:25:20 GMT

I believe you can't rename it from the settings menu - you'll need to move it to the new name.

See this answer.
http://answers.splunk.com/answers/5479/how-to-rename-an-index.html

and this page:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Moveanindex

Re: To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

Abilan1 — Tue, 07 Jul 2015 19:01:01 GMT

Hi Johnson,

Thank you so much for your help!