Deployment Architecture

What actions require restarts?

Explorer

Does anyone have a complete list of configuration changes (via CLI or Manager) that require restarting Splunk?

I would like to limit or schedule these types of changes within my production environment so having a complete list would be very helpful.

Tags (1)

Legend

See Also
What Changes to configuation files require a restart of Splunk?

(sorry to have started a new thread)

0 Karma

Splunk Employee
Splunk Employee

Anything you edit directly in a config file you will have to restart for it to be picked up, apart from props.conf and transforms.conf, which can be reloaded using a search command - http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Extract

| extract reload=true

If you edit something you via the UI, it will automatically tell you if a restart is required, with a 'You need to restart your Splunk instance' message in the top left-hand corner

SplunkTrust
SplunkTrust

There's more to this answer though. The majority of conf file changes can actually be reloaded by hitting the /debug/refresh?entity=/admin/ endpoint. hit /debug/refresh to see all the reloadable entity names listed. Also see Sideview Utils which has a view called "The FreshMaker", which offers a nice UI to hit them all.

0 Karma

Splunk Employee
Splunk Employee

Only search-time relevant entries in props.conf and transforms.conf will be reloaded. Updates of index-time/parsing properties in the conf file will require a restart.

0 Karma