All Apps and Add-ons

Add-on Debug Refresh: Is there a command to only refresh a certain endpoint?

Contributor

Hi,

The Add-on Debug Refresh is very useful, however, the refresh command takes a long time to finish. If I only need to refresh 1 endpoint only, is there a command to reload partially?

e.g. | refresh /servicesNS/admin/search/admin/alert_actions/_reload ?

Thanks in advance!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi shangshin,

basically the command searches within all REST '/servicesNS/admin/search/admin' endpoints for a '_reload' link.
This is what the '/debug/refresh' command does.
If you want to reload only one specific endpoint simple use its URI.

Sorry but I don't have any Splunk server handy to test it.

The '| refresh' command will not support this function, because it was created on the need to reload everything with one single Splunk search command.

cheers,
MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi shangshin,

basically the command searches within all REST '/servicesNS/admin/search/admin' endpoints for a '_reload' link.
This is what the '/debug/refresh' command does.
If you want to reload only one specific endpoint simple use its URI.

Sorry but I don't have any Splunk server handy to test it.

The '| refresh' command will not support this function, because it was created on the need to reload everything with one single Splunk search command.

cheers,
MuS

View solution in original post

SplunkTrust
SplunkTrust

Update:

there will be soon an update to the app released which works on Splunk 7.1.x. It also features the option to only reload one specific entity.

Link to the app: https://splunkbase.splunk.com/app/1871/#/details

cheers, MuS

0 Karma

SplunkTrust
SplunkTrust

Update available here https://splunkbase.splunk.com/app/1871/

cheers, MuS

0 Karma

Splunk Employee
Splunk Employee

@Mus This app reloads everything in Splunk if the savedsearch is enabled (in version 1.0, it is enabled by default). It would be good to add a note on download page, to be cautious not to enable this app in production environments (specifically indexer cluster).

0 Karma

SplunkTrust
SplunkTrust

@mkarikatti Thanks for the feedback on the saved search, I will disable it by default.

But regarding the second comment: I will not add something like this into the notes.
The intention / reason for this app is to reload changed configs on the fly so you can test and validate them (actually I should add this line to the notes of the app 😉 ).
That said, I don't see a reason to put this app on any production instance.

0 Karma

SplunkTrust
SplunkTrust

@mkarikatti, btw in version 2 which is the most recent, the saved search is already disabled 😉

0 Karma

Contributor

Thanks for the reply.

I was using url to reload some config e.g. /debug/refresh?entity=admin/alert_actions

However, I wasn't able to find a way to do this programatically so I started to use this app.

Do you happen to know a way to invoke the URI programatically or using CLI command? Thank you!

0 Karma

SplunkTrust
SplunkTrust

Well, either take a look at the script inside the bin directory of the app or look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTTUT/RESTbasicexamples to get an idea 😉

0 Karma