Getting Data In

Can outputs.conf be reloaded without restarting splunk

kbecker
Communicator

Is there a rest or sysinternal command that can be executed that will reload outputs.conf.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

twinspop
Influencer

Don't forget to use the POST method:

curl -ku admin https://localhost:8089/services/configs/conf-outputs/_reload -X POST
0 Karma

fbl_itcs
Path Finder

I don't think so. Whenever you edit a .conf file directly you need to restart splunk in order to read the changes.

kristian_kolb
Ultra Champion

not always true. props/transforms edits that deal with search-time EXTRACT/REPORT can be reloaded with

| extract reload=t

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...