Must splunk be restarted in order for a manual edit of props.conf to take effect?

[gbenison]

I made an edit to linebreaking in props.conf, then used the CLI "splunk add oneshot " to index a file, saw that new events were indexed, but still according to the old line-breaking scheme. After a splunk restart and another "add oneshot", the new linebreaking scheme was honored. Is a restart each time the only way to incorporate edits to props.conf?

[bwooden · Accepted solution]

For configuration that affect parsing, yes (timestamp identification, line breaking, transforms, etc).

Configurations that are used at search time (lookups, extracts, reports, etc) do not require a restart.

[Ayn]

Not anymore you don't. That used to be the case, but as of 4.x (iirc) each search will be run in its own process so it will read all settings at the time of initialization. So, the latest search-time settings will always be used.

[jpass]

For search time configurations (lookups,extracts,reports etc) I believe you need to append 'extract reload=true' to your sear

| extract reload=true