There is a way to refresh all configuration without restarting Splunk instance, using following:-
This works fine.
I have a requirement where some apps and users (from etc/apps and etc/users) will get copies to my Splunk instance periodically, using shell script. I would like to know a way to achieve this refresh action from the script or saved searches (using REST command). The best solution would be using saved search as I won't have to specify the credentials (as in case of script I might have to).
Any pointer will be of great help. Thanks in advanced.
did you ever get an answer to this? I want to do the same thing, basically I want one of my apps to be checked out from git every so often, and changes would be made to git and not splunk. I haven't figured out how to refresh the app though.