I made an edit to linebreaking in props.conf, then used the CLI "splunk add oneshot
For configuration that affect parsing, yes (timestamp identification, line breaking, transforms, etc).
Configurations that are used at search time (lookups, extracts, reports, etc) do not require a restart.
For configuration that affect parsing, yes (timestamp identification, line breaking, transforms, etc).
Configurations that are used at search time (lookups, extracts, reports, etc) do not require a restart.
Not anymore you don't. That used to be the case, but as of 4.x (iirc) each search will be run in its own process so it will read all settings at the time of initialization. So, the latest search-time settings will always be used.
For search time configurations (lookups,extracts,reports etc) I believe you need to append 'extract reload=true' to your sear
| extract reload=true