topic Re: Reload realtimeoutput.conf without restarting Splunkd in Getting Data In

Reload realtimeoutput.conf without restarting Splunkd

areber04 — Fri, 16 May 2014 15:56:02 GMT

Is it possible to restart the RTO app without restarting Splunkd? We have the RTO app installed on each of our indexers to spread out the load, but bringing down Splunk for 5 minutes while it restarts just to update the output is impacting our users. I have tried using the REST API (servername:8089/services/apps/local/SplunkRealTimeOutput/_reload) but I receive a message on the indexer stating that "realtimeoutput" and "web" require a restart for the changes to take effect. I have also tried using the "enable" and "disable" REST calls, but the result is the same.

Is it possible to reload these configurations without restarting the entire indexer?

Re: Reload realtimeoutput.conf without restarting Splunkd

araitz — Fri, 16 May 2014 21:32:50 GMT

Real-time outputs are in part scripted inputs. Since you are familiar with the REST API, you are ahead of the game. Try POSTing to this endpoint:

 https://af-yolo.sv.splunk.com:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/your\_realtime\_output\/_reload

Re: Reload realtimeoutput.conf without restarting Splunkd

areber04 — Mon, 19 May 2014 14:21:49 GMT

I feel like I'm closer now

curl -k -u admin https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/%252Fopt%252Fsplunk%252Fetc%252Fapps%252FSplunkRealTimeOutput%252Fbin%252Fscripted_inputs%252Frtoutput.py%20917074b6-865f-4c08-9f53-1aa9b5c6d33f/_reload -d ''

Enter host password for user 'admin':


  
    In handler 'script': Invalid custom action for this internal handler (handler: script, custom action: _reload, eai action: edit).

Not sure what I am missing

Re: Reload realtimeoutput.conf without restarting Splunkd

araitz — Mon, 19 May 2014 18:21:43 GMT

Looks like there are actually two actions, both implemented at the collection layer:

 https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/_reload

 https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/restart

According to the docs, I think you want to POST to the restart endpoint.

Re: Reload realtimeoutput.conf without restarting Splunkd

areber04 — Mon, 28 Jul 2014 20:18:32 GMT

To follow up on this:
https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/_reload appears to be the right command. The "restart" command produces an error: In handler 'script': The following required arguments are missing: script.

We are continuing testing to figure out how to get the _reload command to function consistently, but initial results show it working about 75% of the time. There have been several cases where only 3 or 4 out of 6 of our RTO inputs actually reload on a given indexer.