Getting Data In

After making a change to props.conf TIME_FORMAT and SHOULD_LINEMERGE attributes, do I restart splunkd on my deployment server or indexer?

JoeSco27
Communicator

After making a change to my props.conf TIME_FORMAT and SHOULD_LINEMERGE attribute (multiple events started merging together) I want to reload my props.conf. My question is whether i will need to restart splunkd on my deploymentserver or my indexer? I have tried "| extract reload=T" but it did not work.

0 Karma

woodcock
Esteemed Legend

Those are index-time settings so you need to deploy them to your Indexers (and Heavy Forwarders) and restart the Splunk instance (splunkd) on each server.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...