Add-on Debug Refresh: Is there a command to only refresh a certain endpoint?

[shangshin]

Hi,

The Add-on Debug Refresh is very useful, however, the refresh command takes a long time to finish. If I only need to refresh 1 endpoint only, is there a command to reload partially?

e.g. | refresh /servicesNS/admin/search/admin/alert_actions/_reload ?

Thanks in advance!

[MuS · Accepted solution]

Hi shangshin,

basically the command searches within all REST '/servicesNS/admin/search/admin' endpoints for a '_reload' link.
This is what the '/debug/refresh' command does.
If you want to reload only one specific endpoint simple use its URI.

Sorry but I don't have any Splunk server handy to test it.

The '| refresh' command will not support this function, because it was created on the need to reload everything with one single Splunk search command.

cheers,
MuS

[MuS]

Update:

there will be soon an update to the app released which works on Splunk 7.1.x. It also features the option to only reload one specific entity.

Link to the app: https://splunkbase.splunk.com/app/1871/#/details

cheers, MuS

[MuS]

Update available here https://splunkbase.splunk.com/app/1871/

cheers, MuS

[mkarikatti_splu]

@Mus This app reloads everything in Splunk if the savedsearch is enabled (in version 1.0, it is enabled by default). It would be good to add a note on download page, to be cautious not to enable this app in production environments (specifically indexer cluster).

[MuS]

@mkarikatti Thanks for the feedback on the saved search, I will disable it by default.

But regarding the second comment: I will not add something like this into the notes.
The intention / reason for this app is to reload changed configs on the fly so you can test and validate them (actually I should add this line to the notes of the app 😉 ).
That said, I don't see a reason to put this app on any production instance.

[MuS]

@mkarikatti, btw in version 2 which is the most recent, the saved search is already disabled 😉

[shangshin]

Thanks for the reply.

I was using url to reload some config e.g. /debug/refresh?entity=admin/alert_actions

However, I wasn't able to find a way to do this programatically so I started to use this app.

Do you happen to know a way to invoke the URI programatically or using CLI command? Thank you!

[MuS]

Well, either take a look at the script inside the bin directory of the app or look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTTUT/RESTbasicexamples to get an idea 😉