- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After making a change to props.conf TIME_FORMAT and SHOULD_LINEMERGE attributes, do I restart splunkd on my deployment server or indexer?
JoeSco27
Communicator
06-09-2015
08:35 AM
After making a change to my props.conf TIME_FORMAT and SHOULD_LINEMERGE attribute (multiple events started merging together) I want to reload my props.conf. My question is whether i will need to restart splunkd on my deploymentserver or my indexer? I have tried "| extract reload=T" but it did not work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

woodcock
Esteemed Legend
06-09-2015
09:37 AM
Those are index-time
settings so you need to deploy them to your Indexers (and Heavy Forwarders) and restart the Splunk instance (splunkd) on each server.
