Archive

Reloading Transforms from CLI?

New Member

"Enable configuration changes made to transforms.conf by typing the following search in Splunk Web: | extract reload=T"

Is it possible to reload transforms.conf from the CLI? Will restarting Splunk do it if there's no CLI extract reload command?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

This is unnecessary and outdated documentation. transforms.conf is reloaded upon every search. Of course, if you are on an older (3.x or older) version where you need to do this, you can simply run a CLI search with that command.


Update:

If you're making index-time changes, then this doesn't work. Only for search-time configurations take effect immediately. You must generally restart splunkd for index-time changes to take effect. This is true for 4.1.x and earlier. I don't know enough about 4.2 to say for sure if that is the case.

0 Karma

Splunk Employee
Splunk Employee

oh okay. If you're making index-time changes, then no. This is only for search-time configurations. You must generally restart splunkd for index-time changes to take effect. This is true for 4.1.x and earlier. I don't know enough about 4.2 to say for sure if that is the case.

0 Karma

New Member

i.e. splitting logs from multiple clients/environments into separate indexes like so: http://pastebin.com/J1xGX8RU

0 Karma

New Member

We are mainly using Transforms.conf to route raw syslog traffic specific indexes based on the source IP. So if we make changes to transforms.conf, incoming logs will immediately start being routed to the correct index too?

We're also having to update props.conf at the same time, maybe this question is moot if changing props.conf requires a restart anyway.

0 Karma