topic Re: which props files in splunk do not require restarting splunk? in Getting Data In

which props files in splunk do not require restarting splunk?

alexl1 — Wed, 15 May 2013 19:00:01 GMT

hi, when making changes to props files, which props files in splunk do not require restarting splunk and take effect on the fly? thanks,

Re: which props files in splunk do not require restarting splunk?

Ayn — Wed, 15 May 2013 19:07:40 GMT

It's not a matter of which file the settings are in - Splunk reads settings from all props.conf files and merges them. Rather it's a matter of which specific settings. The general rule is that all settings affecting index-time behaviour (event breaking, timestamp parsing, etc) require a restart whereas all search-time settings (field extractions, lookups...) do not.

Re: which props files in splunk do not require restarting splunk?

alexl1 — Wed, 15 May 2013 19:08:42 GMT

thanks xxx

Re: which props files in splunk do not require restarting splunk?

alacercogitatus — Wed, 15 May 2013 19:09:33 GMT

It's more about the settings that are changed, then the files themselves. Search-Time properties (EXTRACT, REPORT, FIELDALIAS, etc) are done "on the fly". Index-time properties (TRANSFORMS, LINE_BREAKER, parsing items, etc) need restarts. When in doubt, wait no more than 10 minutes, and then restart.

Re: which props files in splunk do not require restarting splunk?

ChrisG — Wed, 15 May 2013 19:10:17 GMT

Are you asking about props.conf in particular, or configuration files in general? Changes to props.conf almost always require a restart, see this previous Answers posting.

For a more general answer, see this Answers posting.

You should read the topics about configuration files in the Admin Manual, particularly the topic on configuration file precedence.

Re: which props files in splunk do not require restarting splunk?

Drainy — Wed, 15 May 2013 19:22:06 GMT

I'd disagree that they almost always require a restart, as Ayn posted below, anything search time related takes effect immediately as this part of the props is reloaded each time Splunkd forks off a new process to handle a search.

Re: which props files in splunk do not require restarting splunk?

ChrisG — Wed, 15 May 2013 19:23:22 GMT

Thanks for the refinement, Drainy. 🙂 I appreciate it the correction!

Re: which props files in splunk do not require restarting splunk?

Drainy — Wed, 15 May 2013 19:24:01 GMT

Not to be picky of course 🙂

Re: which props files in splunk do not require restarting splunk?

ChrisG — Wed, 15 May 2013 19:29:22 GMT

No, you would never be. But, if you--hypothetically--were, I would admire you for it.