Is restartSplunkd required for changes to take effect?

[echalex]

Hi,
I'm using the deployment server to deploy, among other things, props.conf files to indexers.

I'm a bit concerned about the impact of indexing, so that's why I'm asking if I'm required to restart splunkd on the indexers for props.conf to be effective, especially if I have both indexers in one class.

[tskinnerivsec]

You can restart the indexers one by one when you make a change. When you assign the app that applies your settings to the indexers assign the app such that it doesn't restart splunkd. You can do this in the serverclass.conf by creating a server class for your indexers and setting restartSplunkd = false.

You can then create an app who's only job is to restart splunkd. That restart app is just an empty app. Then in the serverclass.conf file created a separate server class for each of your indexers with restartSplunkd = true. Then, when you deploy your apps to your indexers, splunkd won't restart until you assign the restart app to the individual indexer class. Once you are done with the restarts, unassign the restart app until next time.

The other saving grace you may have is that the splunk servers will check into the deployment servers at slightly different points of their checkin interval, so both indexers probably won't restart at the same time anyway.

[tskinnerivsec · Accepted solution]

This is a quote from the props.conf example file that ships with splunk:

"The following are example props.conf configurations. Configure properties for your data. # # To use one or more of these configurations, copy the configuration block into # props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations."

I think this may only apply to the props.conf in the system/local directory on the server. I use a deployment server and deploy apps to all of my splunk instances. I have not had any restart issues on indexers when deploying new apps so far.

[sowings]

It's been my experience that props.conf changes don't require restarts any longer. I've had to restart for changes to inputs.conf, outputs.conf and indexes.conf. Otherwise, it should "just work" when deploying these changes with the deployment server.

[echalex]

Thanks. This is probably the best information available. It's just that I would like to restart the indexers one-by-one (preferrably not at all). Of course, I can have one server class per indexer as well.