Can i control the data inputs on universal fowarder with out restrating it ??

[rakesh_498115]

Hi

i have a Universal Fowarder with the following monitor stanza's in it.

[monitor:///project/logs1/]
blacklist = .(gz)$
whitelist = perflog.txt$
followTail = 0
recursive = false
sourcetype = perflogs
index = projectlogs

[monitor:///project/logs2/]
blacklist = .(gz)$
whitelist = perflog.txt$
followTail = 0
recursive = false
sourcetype = perflogs
index = projectlogs

for these two monitoring stanza's . can i able to control the data inputs monitoring with out restarting the UF. i.e property disabled=true/false can i set to these stanza's with out actually restarting them everytime changing in props.conf ?? or can i control this enabling or disabling from other search head ??

Is this possibile??

[yannK]

You can use the CLI command line to edit the config without restarting to apply.\

./splunk disable monitor "/project/logs1/"

[_d_]

You can POST a reload on the respective REST endpoint on the Universal Forwarder. For example:

https://my-universal-forwarder:8089/services/data/inputs/monitor/_reload

[rakesh_498115]

Thanks .. can i give it for a particular montior stanza ??