Deployment Architecture

Splunk configuration changes - SIGHUP or restart?

araitz
Splunk Employee
Splunk Employee

Sometimes I make changes to my Splunk server's configuration, but I do not want to restart Splunk.

Which configuration changes require a restart, and which do not?

Also, does Splunk support a SIGHUP on linux/unix systems?

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

In general, settings which affect search take effect immediately, since searches are run in a separate process that reloads configurations. These settings include lookup tables, field extractions, tags and eventtypes.

Settings which affect indexing usually require a restart. These include index time field extractions, timestamp properties and index creation.

Input settings made through the UI and CLI do not require restarts and take place immediately.

Splunk doesn't yet support SIGHUP on unix systems, but that is certainly a commonly desired feature.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

In general, settings which affect search take effect immediately, since searches are run in a separate process that reloads configurations. These settings include lookup tables, field extractions, tags and eventtypes.

Settings which affect indexing usually require a restart. These include index time field extractions, timestamp properties and index creation.

Input settings made through the UI and CLI do not require restarts and take place immediately.

Splunk doesn't yet support SIGHUP on unix systems, but that is certainly a commonly desired feature.

jrodman
Splunk Employee
Splunk Employee

Heehee sending splunk a SIGHUP causes it to shut down. So you probably don't want to do this.

Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...