Deployment Architecture
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Must splunk be restarted in order for a manual edit of props.conf to take effect?

gbenison
Engager

I made an edit to linebreaking in props.conf, then used the CLI "splunk add oneshot " to index a file, saw that new events were indexed, but still according to the old line-breaking scheme. After a splunk restart and another "add oneshot", the new linebreaking scheme was honored. Is a restart each time the only way to incorporate edits to props.conf?

Tags (2)
1 Solution

bwooden
Splunk Employee
Splunk Employee

For configuration that affect parsing, yes (timestamp identification, line breaking, transforms, etc).

Configurations that are used at search time (lookups, extracts, reports, etc) do not require a restart.

View solution in original post

bwooden
Splunk Employee
Splunk Employee

For configuration that affect parsing, yes (timestamp identification, line breaking, transforms, etc).

Configurations that are used at search time (lookups, extracts, reports, etc) do not require a restart.

View solution in original post

Ayn
Legend

Not anymore you don't. That used to be the case, but as of 4.x (iirc) each search will be run in its own process so it will read all settings at the time of initialization. So, the latest search-time settings will always be used.

jpass
Contributor

For search time configurations (lookups,extracts,reports etc) I believe you need to append 'extract reload=true' to your sear

| extract reload=true

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!