topic Re: Reload database.conf without restarting Splunk. in Monitoring Splunk

Reload database.conf without restarting Splunk.

dfronck — Wed, 10 Dec 2014 17:06:53 GMT

We're monitoring a lot of databases and we have to change passwords frequently.
We have a password manager that changes an account's DB password and then calls a python script with the account name and the new password. Our python script uses a DBX python script to encrypt the password and then our script replaces the old encrypted password with the new one but Splunk does not see the change until we restart Splunk.

I know that I can reload input.conf by running

splunk _internal call /services/data/inputs/monitor/_reload -auth admin:$ADMINPWD

but this doesn't seem to reload "/opt/splunk/etc/apps/dbx/local/database.conf"

Is there a command that will reload database.conf?

Re: Reload database.conf without restarting Splunk.

changux — Wed, 10 Dec 2014 19:37:32 GMT

If some like this:

http(s)://SPLUNKHOST:8000/debug/refresh

Doesn't work, the only way is restarting.

Re: Reload database.conf without restarting Splunk.

dfronck — Thu, 11 Dec 2014 01:20:21 GMT

splunk _internal call /services/apps/local/dbx/_reload -auth admin:$ADMINPWD

Restarts the DBX app. Restarting the app also encrypts plaintext passwords in database.conf so we're updating our script to just replace the old encrypted password with the new plaintext password. Much simpler.