Deployment Architecture

Why does the "splunk rebuild" command require restarting Splunk?

Builder

I had thought that splunk have to restart when configuration file such as "*.conf" was changed.

However, if I did "splunk rebuild" command, I need to restart splunk.
Why is it necessary to restart splunk even though it is just reloading the archived data again?
Is processing of rebuild different from usual data acquisition?.

I think that it is difficult to publish internal processing, so I would be pleased if you can tell me type of case it will be necessary to restart.

0 Karma
1 Solution

Path Finder

Archived/Fozen data is not searchable in Splunk as you're probably aware.

When you rebuild the data is loaded to the nominated thawed directory. This process is different from the initial indexing. When Splunk is restarted the search flags are reallocated by splunkd which is why you must restart.

Hope this helps.

View solution in original post

0 Karma

Path Finder

Archived/Fozen data is not searchable in Splunk as you're probably aware.

When you rebuild the data is loaded to the nominated thawed directory. This process is different from the initial indexing. When Splunk is restarted the search flags are reallocated by splunkd which is why you must restart.

Hope this helps.

View solution in original post

0 Karma

Builder

Thank you very polite commentary.

Thanks to your comment, I could understand that I have to restart Splunk to index the rebuilt data.

0 Karma