What actions require restarts?

[pdevlin]

Does anyone have a complete list of configuration changes (via CLI or Manager) that require restarting Splunk?

I would like to limit or schedule these types of changes within my production environment so having a complete list would be very helpful.

[lguinn2]

See Also
What Changes to configuation files require a restart of Splunk?

(sorry to have started a new thread)

[Mick]

Anything you edit directly in a config file you will have to restart for it to be picked up, apart from props.conf and transforms.conf, which can be reloaded using a search command - http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Extract

| extract reload=true

If you edit something you via the UI, it will automatically tell you if a restart is required, with a 'You need to restart your Splunk instance' message in the top left-hand corner

[sideview]

There's more to this answer though. The majority of conf file changes can actually be reloaded by hitting the /debug/refresh?entity=/admin/ endpoint. hit /debug/refresh to see all the reloadable entity names listed. Also see Sideview Utils which has a view called "The FreshMaker", which offers a nice UI to hit them all.

[gkanapathy]

Only search-time relevant entries in props.conf and transforms.conf will be reloaded. Updates of index-time/parsing properties in the conf file will require a restart.