topic Re: Can you change/develop/tune/test indexing time transformations (props.conf) without restarting a Splunk instance? in Getting Data In

Can you change/develop/tune/test indexing time transformations (props.conf) without restarting a Splunk instance?

atemourt — Fri, 14 Sep 2018 12:16:33 GMT

Hello Splunkers,

Is there any way how to change/develop/tune/test indexing time transformations (props configurations) without need of restart of a Splunk instance?

Thanks in advance!
Afroditi

Re: Can you change/develop/tune/test indexing time transformations (props.conf) without restarting a Splunk instance?

harsmarvania57 — Fri, 14 Sep 2018 13:02:34 GMT

Hi @atemourt,

You can use this URL http[s]://<hostname>:<splunkweb_port>/debug/refresh to refresh configuration.

Re: Can you change/develop/tune/test indexing time transformations (props.conf) without restarting a Splunk instance?

sudosplunk — Fri, 14 Sep 2018 13:13:53 GMT

If the configurations are effecting index-time (the way splunk index data) operations, then restart is required.

If configurations are effecting search-time operations, then you can perform debug refresh as suggested by @harsmarvania57.

Please refer to this doc for more details.

Re: Can you change/develop/tune/test indexing time transformations (props.conf) without restarting a Splunk instance?

muralimadhavan — Wed, 24 Oct 2018 13:52:53 GMT

To reload your endpoints type the following into your browser:

http://:8000/en-US/debug/refresh

In addition, index-time props and transforms do not require restarts, as long as your indexers are receiving the data from forwarders. That is to say:

Changes to props.conf and transforms.conf on an indexer do not require restarts.
In an indexer cluster, changes to props.conf and transforms.conf are automatically reloaded when the peers receive the changes from the master.
On a non-clustered indexer, changes to props.conf and transforms.conf require a reload.
On either a clustered or non-clustered indexer, once the .conf files have reloaded, the changes take effect after a forwarder auto-LB time period.

Refer this page

https://docs.splunk.com/Documentation/Splunk/7.2.0/Admin/Configurationfilechangesthatrequirerestart