topic Re: Effect the change in Splunk in Splunk Search https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115247#M183854 <P>Absolutly right, MuS - but in some cases very useful <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 23 Jun 2014 14:39:59 GMT Rocket66 2014-06-23T14:39:59Z Effect the change in Splunk https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115242#M183849 <P>Hi,</P> <P>Whenever I make any changes in the splunk configuation file, I need to restart splunk services to effect the changes made. </P> <P>Do I have any alternative so that the changes will be effected without restarting splunk services ?</P> <P>Please help !!</P> <P>Many thanks for your kind support !!</P> Mon, 23 Jun 2014 09:13:58 GMT https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115242#M183849 abhayneilam 2014-06-23T09:13:58Z Re: Effect the change in Splunk https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115243#M183850 <P>Hi abhayneilam,</P> <P>As a rule of thumb you can go by: usually anything that affects indexing level changes require a splunk restart, while search level changes require a reload. Here's a good guideline on how to determine which is which.<BR /><BR /> <A href="http://www.splunk.com/base/Documentation/latest/admin/Indextimeversussearchtime" rel="nofollow"></A><A href="http://www.splunk.com/base/Documentation/latest/admin/Indextimeversussearchtime">http://www.splunk.com/base/Documentation/latest/admin/Indextimeversussearchtime</A></P> <P>So index creation or settings modifications, props.conf time stamp extractions, or transforms.conf indexed field modifications as well as most .conf manual changes will require a restart.</P> <P>If you make changes with $SPLUNK_HOME/bin/splunk CLI changes or within the UI, it wont require a restart....unless of course you get prompted for a restart</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Mon, 23 Jun 2014 09:44:25 GMT https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115243#M183850 MuS 2014-06-23T09:44:25Z Re: Effect the change in Splunk https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115244#M183851 <P>Thanks a lot for the prompt reply !!</P> Mon, 23 Jun 2014 11:58:29 GMT https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115244#M183851 abhayneilam 2014-06-23T11:58:29Z Re: Effect the change in Splunk https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115245#M183852 <P>You can also use the http://[SPLUNKSERVER]:8000/en-us/debug/refresh to reload conf-files <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 23 Jun 2014 13:38:40 GMT https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115245#M183852 Rocket66 2014-06-23T13:38:40Z Re: Effect the change in Splunk https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115246#M183853 <P>be aware that this does not refresh all endpoints, only</P> <P>data/ui/[manager|nav|views]</P> <P>and <CODE>admin</CODE> endpoints:<BR /> conf-times<BR /> alert_actions<BR /> clusterconfig<BR /> commandsconf<BR /> conf-deploymentclient<BR /> conf-inputs<BR /> conf-times<BR /> conf-wmi<BR /> cooked<BR /> datamodel-files<BR /> datamodelacceleration<BR /> datamodeledit<BR /> deploymentserver<BR /> eventtypes<BR /> fields<BR /> fifo<BR /> fvtags<BR /> indexes<BR /> localapps<BR /> lookup-table-files<BR /> macros<BR /> manager<BR /> monitor<BR /> nav<BR /> passwords<BR /> pools<BR /> quickstart<BR /> raw<BR /> savedsearch<BR /> scheduledviews<BR /> script<BR /> sourcetypes<BR /> ssl<BR /> syslog<BR /> tcpout-default<BR /> tcpout-group<BR /> tcpout-server<BR /> transforms-extract<BR /> transforms-lookup<BR /> udp<BR /> ui-prefs<BR /> views<BR /> viewstates<BR /> workflow-actions</P> Mon, 23 Jun 2014 14:36:05 GMT https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115246#M183853 MuS 2014-06-23T14:36:05Z Re: Effect the change in Splunk https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115247#M183854 <P>Absolutly right, MuS - but in some cases very useful <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 23 Jun 2014 14:39:59 GMT https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115247#M183854 Rocket66 2014-06-23T14:39:59Z Re: Effect the change in Splunk https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115248#M183855 <P>It sure is a time saver <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 23 Jun 2014 14:42:30 GMT https://community.splunk.com/t5/Splunk-Search/Effect-the-change-in-Splunk/m-p/115248#M183855 DavidHourani 2014-06-23T14:42:30Z