topic Re: Is there a way not to restart entire splunk instance after making changes in .conf files? in Splunk Search

Is there a way not to restart entire splunk instance after making changes in .conf files?

krishnakanthgup — Thu, 16 Nov 2017 05:26:36 GMT

In general after we make changes in .conf files splunk instance should restart. If we deploy splunk in production environment and after making changes in .conf files a restart of entire splunk might be problem. so, is there any way we can resolve this problem?

Re: Is there a way not to restart entire splunk instance after making changes in .conf files?

nickstone — Thu, 16 Nov 2017 05:34:03 GMT

If its just a change to a search time transforms.conf, you could use the following SPL:
| extract reload=t

Re: Is there a way not to restart entire splunk instance after making changes in .conf files?

krishnakanthgup — Thu, 16 Nov 2017 06:14:12 GMT

Thanks Nickstone. but what if it was a props.conf file?

Re: Is there a way not to restart entire splunk instance after making changes in .conf files?

gjanders — Fri, 17 Nov 2017 08:58:30 GMT

As per the props.conf documentation:
# You can enable configurations changes made to props.conf by typing the
# following search string in Splunk Web:
#
# | extract reload=T

So yes that will work for props and transforms.conf