Getting Data In

If we make changes in .conf files is there a way not to restart entire splunk?

kanamarlapudi
New Member

In general if we make changes in .conf files we need to restart splunk. Suppose splunk is deployed in production environment and if the changes are made in .conf restarting entire splunk might cause a problem. is there any way instead of restarting entire splunk?

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

You can hit below URL to reload configuration file..

http[s]://[splunkweb hostname]:[splunkweb port]/debug/refresh

If you are working with extractions (props.conf / transform.cong) then below will work.

YOUR_SEARCh | extract reload=true 

Happy Splunking

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

You can hit below URL to reload configuration file..

http[s]://[splunkweb hostname]:[splunkweb port]/debug/refresh

If you are working with extractions (props.conf / transform.cong) then below will work.

YOUR_SEARCh | extract reload=true 

Happy Splunking

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @kanamarlapudi,

When you make changes to Splunk Enterprise using the configuration files, you might need to restart Splunk Enterprise for the changes to take effect.

When to restart splunkd:

As a general rule, anything that modifies:

  1. Settings and properties that affect indexers and indexing behavior
  2. Settings and properties that affect users and roles.
  3. Settings and properties that affect Splunk's core configuration.

Splunk Enterprise changes that do not require a restart

  1. Lookup tables
  2. Field extractions
  3. Knowledge objects
  4. Tags
  5. Event types
  6. Props and transforms that hit the following endpoints: /configs/conf-props/_reload /configs/conf-transforms/_reload /admin/transforms-reload

Please check below link for detail information.

http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Configurationfilechangesthatrequirerestart

Happy Splunking

0 Karma

kanamarlapudi
New Member

Thank You Kamlesh. It's really helpful.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @kanamarlapudi,

Glad to help you. Please accept the answer to close this question and upvote my comment which helps you.

Happy Splunking

0 Karma

harsmarvania57
Ultra Champion

Hi @kanamarlapudi,

Can you please let us know which .conf files you are talking about because some of the .conf files requires restart. For example : if you are removing index from indexes.conf then you need to restart splunk.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...