topic Re: REST servicesNS reload index conf in Getting Data In

REST servicesNS reload index conf

brdr — Fri, 14 Feb 2020 17:38:19 GMT

We need the ability , from CLI (Linux) to reload indexes.conf. I run the command below and it succeeds.

curl -X POST -k -u admin:pwd https://localhost:8089/servicesNS/-/-/admin/indexes/_reload

We push changes (like adding a new index) to indexes.conf of the splunk instance. I do not want to restart splunk to see the new index showing up in the GUI. After the above is executed, i log back into Splunk, go to Settings-Indexes and do NOT see the new index.

Any idea why i do not see it? If i restart splunk i wil see it in the GUI.

Thx

Re: REST servicesNS reload index conf

brdr — Fri, 14 Feb 2020 18:06:28 GMT

Note that I am using the admin user.

Re: REST servicesNS reload index conf

woodcock — Fri, 14 Feb 2020 20:11:32 GMT

I think that it should work but the way that I would deploy this is:
Update indexes.conf on each indexer.
Hit the REST endpoint on eachIndexer.
Update indexes.conf on Search Head.
Hit the REST endpoint on the Search Head.
I would expect that to work.
If not, try the full debug/refresh endpoint.

Re: REST servicesNS reload index conf

arjunpkishore5 — Fri, 14 Feb 2020 20:30:46 GMT

have you tried using the cli ?

$SPLUNK_HOME/bin/splunk reload index

Full cli reference here - https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/CLIadmincommands

Re: REST servicesNS reload index conf

brdr — Wed, 30 Sep 2020 04:12:45 GMT

Thanks for feedback. That reload command was one of the things i tried. it doesn't work. i get this in the log: It just doesn't see the new index in indexes.conf.

2-14-2020 20:43:15.256 +0000 INFO IndexProcessor - reloading index config: start
02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - request state change from=RUN to=RECONFIGURING02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - Initializing: readonly=false reloading=true
02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - Got a list of count=0 added, modified, or removed indexes02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - Reloading index config: shutdown subordinate threads, now restarting
02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - Initializing indexes took usec=3 reloading=true indexes_initialized=0
02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - request state change from=RECONFIGURING to=RUN
02-14-2020 20:43:15.257 +0000 INFO IndexProcessor - reloading index config: end
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - reloading index config: start
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - request state change from=RUN to=RECONFIGURING
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - Initializing: readonly=false reloading=true
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - Got a list of count=0 added, modified, or removed indexes
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - Reloading index config: shutdown subordinate threads, now restarting
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - Initializing indexes took usec=2 reloading=true indexes_initialized=0
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - request state change from=RECONFIGURING to=RUN
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - reloading index config: end

Re: REST servicesNS reload index conf

brdr — Fri, 14 Feb 2020 20:50:18 GMT

No dice. The commands work fine, i can see entries in the splunkd.log that the commands are hitting the endpoint but, when i go into the GUI -> Settings -> Indexes the new index is NOT there.

Re: REST servicesNS reload index conf

brdr — Fri, 14 Feb 2020 21:05:30 GMT

So, i guess the question is, what indexes.conf is the reload looking at, as it is clearly not looking at our local indexes.conf which is in a separate custom app etc/apps/prod_indexes/local/indexes.conf.

Re: REST servicesNS reload index conf

arjunpkishore5 — Fri, 14 Feb 2020 21:18:39 GMT

can you run btool to check if the new index is visible ?

Re: REST servicesNS reload index conf

woodcock — Fri, 14 Feb 2020 22:40:53 GMT

Time to open another support case.

Re: REST servicesNS reload index conf

isoutamo — Fri, 14 Feb 2020 22:45:34 GMT

If I recall right you could not see the index before it has any data.

R. Ismo

Re: REST servicesNS reload index conf

brdr — Mon, 17 Feb 2020 14:29:18 GMT

it is visible via btool as soon as i add an index to our indexes.conf