topic Re: How do you reload config files via the CLI or REST API? in Getting Data In

How do you reload config files via the CLI or REST API?

thisissplunk — Wed, 30 May 2018 20:57:31 GMT

I need to do the equivalent of this:

https://oursplnkserver.com/en-GB/debug/refresh?entity=admin/conf-inputs

before I use the rest api to check for input stanzas like this:

https://oursplunkserver.com:8089/services/configs/inputs?output_mode=json&count=0

The reason you and I would need to do this is to refresh the inputs so that we can list what actually sits in the config files. For instance, if you just went into the CLI to add an input stanza to inputs.conf and save it, IT WILL NOT SHOW UP IN THE REST API CALL!

So my solution was to refresh the configs first, but there seems to be no automated way to do this! For the debug/refresh page, you must click on a button.

Is there a way to achieve this via the CLI or api? I saw "reload deploy-server" suggested in other answers but that does not work.

Re: How do you reload config files via the CLI or REST API?

thisissplunk — Wed, 30 May 2018 21:14:30 GMT

I've found a way to do it via CLI but I'd prefer an API way, because why am I using the API at this point if I'm just doing things via the CLI?

Anyways, for input files this refreshes them:

./splunk reload monitor

There are more for things such as indexes if you type "./splunk help reload"

Re: How do you reload config files via the CLI or REST API?

vsingla1 — Tue, 29 Sep 2020 21:21:07 GMT

Just to add this, you can refresh the entitities without explicitly hitting the endpoint, you can do so by CLI from the below command:
curl -u admin: -X POST http://:8089/servicesNS/-/-/admin/transforms-reload/_reload

above is an example of reloading the transforms entity, but in a similar way, you can do reload for other entities as well.

a list of all entities is as below:

Refreshing admin/conf-times OK
Refreshing data/ui/manager OK
Refreshing data/ui/nav OK
Refreshing data/ui/views OK
Refreshing admin/alert_actions OK
Refreshing admin/applicense SplunkdConnectionException Splunkd daemon is not responding: ("Error connecting to /servicesNS/nobody/search/admin/applicense/_reload: ('The read operation timed out',)",)
Refreshing admin/clusterconfig OK
Refreshing admin/collections-conf OK
Refreshing admin/commandsconf OK
Refreshing admin/conf-checklist OK
Refreshing admin/conf-deploymentclient OK
Refreshing admin/conf-inputs OK
Refreshing admin/conf-times OK
Refreshing admin/conf-wmi OK
Refreshing admin/cooked OK
Refreshing admin/crl ResourceNotFound Invalid action for this internal handler (handler: crl, supported: list|_reload, wanted: list).
Refreshing admin/datamodel-files OK
Refreshing admin/datamodelacceleration OK
Refreshing admin/datamodeledit OK
Refreshing admin/dataset_consolidation_datamodeleditOK
Refreshing admin/deploymentserver OK
Refreshing admin/distsearch-peer OK
Refreshing admin/eventtypes OK
Refreshing admin/fields OK
Refreshing admin/fifo OK
Refreshing admin/fvtags OK
Refreshing admin/http OK
Refreshing admin/indexer-discovery-configOK
Refreshing admin/indexes OK
Refreshing admin/limits OK
Refreshing admin/livetail OK
Refreshing admin/localapps OK
Refreshing admin/lookup-table-files OK
Refreshing admin/macros OK
Refreshing admin/manager OK
Refreshing admin/messages-conf OK
Refreshing admin/modalerts OK
Refreshing admin/monitor OK
Refreshing admin/nav OK
Refreshing admin/panels OK
Refreshing admin/passwords OK
Refreshing admin/pools OK
Refreshing admin/proxysettings OK
Refreshing admin/quickstart OK
Refreshing admin/raw OK
Refreshing admin/remote_eventlogs OK
Refreshing admin/remote_indexes BadRequest The following required arguments are missing: repositoryLocation.
Refreshing admin/remote_monitor OK
Refreshing admin/remote_perfmon OK
Refreshing admin/remote_raw OK
Refreshing admin/remote_script OK
Refreshing admin/remote_udp OK
Refreshing admin/savedsearch OK
Refreshing admin/scheduledviews OK
Refreshing admin/script OK
Refreshing admin/search-head-bundles OK
Refreshing admin/serverclasses OK
Refreshing admin/shclusterconfig OK
Refreshing admin/sourcetypes OK
Refreshing admin/splunktcptoken OK
Refreshing admin/ssl OK
Refreshing admin/syslog OK
Refreshing admin/tcpout-default OK
Refreshing admin/tcpout-group OK
Refreshing admin/tcpout-server OK
Refreshing admin/telemetry OK
Refreshing admin/transforms-extract OK
Refreshing admin/transforms-lookup OK
Refreshing admin/transforms-reload OK
Refreshing admin/udp OK
Refreshing admin/ui-prefs OK
Refreshing admin/ui-tour OK
Refreshing admin/views OK
Refreshing admin/viewstates OK
Refreshing admin/vix-indexes OK
Refreshing admin/vix-providers OK
Refreshing admin/workflow-actions OK
DONE

Re: How do you reload config files via the CLI or REST API?

inderjot — Thu, 13 Apr 2023 16:12:50 GMT

Do we have something similar for Splunk cloud?

Is there option to do debug/refresh in Splunk cloud via ACS?

Re: How do you reload config files via the CLI or REST API?

woodcock — Fri, 14 Apr 2023 18:16:59 GMT

You can schedule a cron job to do this.
You can also schedule a search using this app:
https://splunkbase.splunk.com/app/1871

Re: How do you reload config files via the CLI or REST API?

spunk_enthusias — Tue, 18 Apr 2023 12:56:20 GMT

This doesn't seem to work for clearing the scripts cache ($SPLUNK_API/servicesNS/-/-/admin/script/_reload). It's not equivalent to $SPLUNK_WEB/en-US/debug/refresh?entity=admin/script.