topic Reloading savedsearches for given app in Reporting

Reloading savedsearches for given app

althomas — Thu, 15 Apr 2021 09:38:01 GMT

Hi all,

Previously we used to use the endpoint /servicesNS/nobody/my_app_name/admin/savedsearch/_reload to reload savedsearches while the search head was online.

Since moving to Splunk 8, this endpoint does nothing. Searches are still running if I set disabled=1 manually in the config, yet the endpoint returns a 200 OK, as below:

/opt/splunk//bin/splunk _internal call /servicesNS/-/-/admin/savedsearch/_reload -user admin QUERYING: 'https://127.0.0.1:8089/servicesNS/-/-/admin/savedsearch/_reload' HTTP Status: 200. Content: <?xml version="1.0" encoding="UTF-8"?>  <?xml-stylesheet type="text/xml" href="/static/atom.xsl"?> <feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"> <title>savedsearch</title> <id>https://127.0.0.1:8089/servicesNS/-/-/admin/savedsearch</id> <updated>2021-04-15T11:22:04+02:00</updated> <generator build="63079c59e632" version="8.1.3"/> <author> <name>Splunk</name> </author> <link href="/servicesNS/-/-/admin/savedsearch/_new" rel="create"/> <link href="/servicesNS/-/-/admin/savedsearch/_reload" rel="_reload"/> <link href="/servicesNS/-/-/admin/savedsearch/_acl" rel="_acl"/> <opensearch:totalResults>0</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> </feed>

Has this changed? Are we not able to manually hit this endpoint anymore?

We can still hit https://localhost:8089/en-GB/debug/refresh to reload all entities (specifying entity=admin/savedsearch doesn't seem to work either), but this can time out on behemoth search heads and leaves us having to restart the search head if the config is not applying.

Is there anything we can do about this? How do we trigger a manual reload of the savedsearch config in Splunk 8?

Thanks!
Kind regards,
Alex

Re: Reloading savedsearches for given app

althomas — Thu, 15 Apr 2021 10:57:37 GMT

As far as I can tell, this is a bug.

Documentation: https://docs.splunk.com/Documentation/Splunk/8.1.3/RESTUM/RESTusing#Reload_endpoint
Excerpt:

Reload endpoint

Append _reload to a URL to force the server to reload data for the endpoint:

curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/saved/searches/_reload

You can use _reload for all saved searches but not for a single saved search.

If we run this:

curl -k -u admin https://localhost:8089/servicesNS/nobody/search/saved/searches/_reload Enter host password for user 'admin': <?xml version="1.0" encoding="UTF-8"?>  <?xml-stylesheet type="text/xml" href="/static/atom.xsl"?> <feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"> <title>savedsearch</title> <id>https://localhost:8089/servicesNS/nobody/search/saved/searches</id> <updated>2021-04-15T12:56:45+02:00</updated> <generator build="63079c59e632" version="8.1.3"/> <author> <name>Splunk</name> </author> <link href="/servicesNS/nobody/search/saved/searches/_new" rel="create"/> <link href="/servicesNS/nobody/search/saved/searches/_reload" rel="_reload"/> <link href="/servicesNS/nobody/search/saved/searches/_acl" rel="_acl"/> <opensearch:totalResults>0</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> </feed>

we get a 200/OK but still no update

Re: Reloading savedsearches for given app

morawi5 — Wed, 09 Jun 2021 17:08:47 GMT

Any update on this? We can't manually hit this one and have it update either.

Re: Reloading savedsearches for given app

althomas — Thu, 10 Jun 2021 08:23:05 GMT

Thanks for reminding me that I still had this open. This is fixed in version 8.1.4. I escalated to support.

that this specific behavior matches our internal case SPL-203763 "savedsearches.conf is not updated after upgrading to 8.1.0 because REST API endpoint is not reloaded". It has been now fixed on Splunk version 8.1.4. Please let me know if I can be of any further assistance.

Re: Reloading savedsearches for given app

morawi5 — Thu, 10 Jun 2021 14:07:39 GMT

Workaround below:

Use endpoint /servicesNS/nobody/<app_name>/admin/localapps/_reload with GET request