topic do you have to restart Splunk when you've added a custom search command? in Splunk Search

do you have to restart Splunk when you've added a custom search command?

piebob — Wed, 14 Jul 2010 00:15:18 GMT

if i create a custom search command as described in http://www.splunk.com/base/Documentation/latest/SearchReference/Aboutcustomsearchcommands do i have to restart Splunk before it'll work?

Re: do you have to restart Splunk when you've added a custom search command?

Genti — Wed, 14 Jul 2010 00:41:19 GMT

i think the rule of thumb is that if it is a *.conf file that is being edited you need a Splunk restart..(?)

Re: do you have to restart Splunk when you've added a custom search command?

gkanapathy — Wed, 14 Jul 2010 05:20:21 GMT

Not a very accurate rule of thumb. Editing many search-time configurations (regardless of the conf file) does not require a restart of Splunk to take effect. Some do, however, notably savedsearches.conf. I believe that creating a new command in commands.conf requires a restart. However, changing the command script or commands.conf parameters for an existing command do not require a restart.

Re: do you have to restart Splunk when you've added a custom search command?

npandith — Wed, 13 Oct 2010 13:33:45 GMT

If you are trying to modify the commands.conf file then you no need to restart the splunk. If you are creating a new command then you need to restart the splunk for sure.

Re: do you have to restart Splunk when you've added a custom search command?

Lowell — Wed, 13 Oct 2010 20:51:33 GMT

Using the "getinfo" feature does reduce the need to restart splunk for certain parameter changes. For example, streaming, generating, preop, ... are all determine within the script (which can be changed at any time since splunk launches a new copy for each search). Take a look at splunk.Intersplunk.outputInfo() for more info. This has saved me from having to restart splunk a few times, but your millage may vary.