topic Re: Is restart required after making changes to Props.conf and Transforms.conf? in Getting Data In

Is restart required after making changes to Props.conf and Transforms.conf?

echojacques — Mon, 19 Aug 2013 15:22:33 GMT

Do I need to restart Splunk after I make changes to Props.conf and Transforms.conf for the changes to take effect?

Thanks

Re: Is restart required after making changes to Props.conf and Transforms.conf?

lukejadamec — Mon, 19 Aug 2013 15:33:40 GMT

No. Not if the changes are search time transforms on the indexer. You should be able to issue the following command in a splunkweb search:| extract reload=t, this is an old instruction, but it is still in the documentation (it can't hurt). Search time transform instructions are read when the search is run.

Yes, if it is an index time transform on the indexer.

Yes. If the changes are on the forwarders - you need to restart the forwarder, but it has to be a heavy forwarder. Index time transforms don't work on universal forwarders, and search time extractions don't make sense on a forwarder. With regard to forwarders, if the changes are part of a deployed app configured to restart after changes, then this would happen automatically.

Re: Is restart required after making changes to Props.conf and Transforms.conf?

linu1988 — Mon, 19 Aug 2013 15:57:57 GMT

You actually do as per the splunk documentation,

props.conf.example

Version 5.0.4

The following are example props.conf configurations. Configure properties for your data.

To use one or more of these configurations, copy the configuration block into
props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.

Re: Is restart required after making changes to Props.conf and Transforms.conf?

Ayn — Mon, 19 Aug 2013 16:12:28 GMT

This is incorrect. Whether you need to restart or not depends on if the change is related to a index-time setting or search-time setting. Index-time settings include line breaking, timestamp parsing among other things. Search-time settings relate mainly to field extraction and creation. This has nothing to do with whether the Splunk instance is an indexer or not.

Re: Is restart required after making changes to Props.conf and Transforms.conf?

Ayn — Mon, 19 Aug 2013 16:13:48 GMT

Additionally, extract reload=t is no longer required (it hasn't been since at least 4.x I think) - all searches now start their own process and read their configuration upon start, so they will automatically get the latest available configuration.

Re: Is restart required after making changes to Props.conf and Transforms.conf?

echojacques — Mon, 28 Sep 2020 14:36:10 GMT

Thanks for the corrections. So this is a transforms.conf for my OPSECLEA configuration on my main Splunk indexer (not forwarder) which I think is real-time indexing. So do I need to restart after a change to \data\splunk\apps\Splunk_TA_opseclea_linux22\local\transforms.conf?

Re: Is restart required after making changes to Props.conf and Transforms.conf?

Ayn — Mon, 19 Aug 2013 16:31:51 GMT

transforms.conf can hold both index-time and search-time settings, so it's not possible to to say just from the filename if you will need to restart or not.

Re: Is restart required after making changes to Props.conf and Transforms.conf?

echojacques — Mon, 19 Aug 2013 16:54:04 GMT

Hate to be such a newbie, but how do I tell if it's index-time or search-time? My guess is that it's index-time since the stanza that I'm working with deals with preventing certain events from getting indexed in the first place.

Re: Is restart required after making changes to Props.conf and Transforms.conf?

lukejadamec — Mon, 19 Aug 2013 17:06:47 GMT

Don't feel bad for being new.

You are correct, if you are preventing items from being indexed, then it is an index time transform.
Let me guess, sending something to nullQueue?

Re: Is restart required after making changes to Props.conf and Transforms.conf?

echojacques — Mon, 19 Aug 2013 19:55:36 GMT

Yes, trying to exclude certain events from being indexed... I've been working on this for a few days. Continually tweaking props.conf, transforms.conf, then restarting... trying to prevent certain events from being indexed. I'll get it eventually...

Re: Is restart required after making changes to Props.conf and Transforms.conf?

lukejadamec — Mon, 19 Aug 2013 20:07:54 GMT

Shall I delete my answer? The -2 is making me look bad.

Re: Is restart required after making changes to Props.conf and Transforms.conf?

echojacques — Mon, 19 Aug 2013 20:30:55 GMT

I'm not the one that voted it down. i just voted it up one level.

Re: Is restart required after making changes to Props.conf and Transforms.conf?

DUThibault — Tue, 06 Feb 2018 20:49:14 GMT

Index time transforms don't work on universal forwarders

Not true. With Splunk 7, at least, you can have universal forwarders do index work simply by adding force_local_processing = true to the forwarder's props.conf [<sourcetype>] and [source::<source>] stanzas.