REST servicesNS reload index conf

[brdr]

We need the ability , from CLI (Linux) to reload indexes.conf. I run the command below and it succeeds.

curl -X POST -k -u admin:pwd https://localhost:8089/servicesNS/-/-/admin/indexes/_reload

We push changes (like adding a new index) to indexes.conf of the splunk instance. I do not want to restart splunk to see the new index showing up in the GUI. After the above is executed, i log back into Splunk, go to Settings-Indexes and do NOT see the new index.

Any idea why i do not see it? If i restart splunk i wil see it in the GUI.

Thx

[arjunpkishore5]

have you tried using the cli ?

$SPLUNK_HOME/bin/splunk reload index

Full cli reference here - https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/CLIadmincommands

[brdr]

Thanks for feedback. That reload command was one of the things i tried. it doesn't work. i get this in the log: It just doesn't see the new index in indexes.conf.

2-14-2020 20:43:15.256 +0000 INFO IndexProcessor - reloading index config: start
02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - request state change from=RUN to=RECONFIGURING02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - Initializing: readonly=false reloading=true
02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - Got a list of count=0 added, modified, or removed indexes02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - Reloading index config: shutdown subordinate threads, now restarting
02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - Initializing indexes took usec=3 reloading=true indexes_initialized=0
02-14-2020 20:43:15.256 +0000 INFO IndexProcessor - request state change from=RECONFIGURING to=RUN
02-14-2020 20:43:15.257 +0000 INFO IndexProcessor - reloading index config: end
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - reloading index config: start
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - request state change from=RUN to=RECONFIGURING
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - Initializing: readonly=false reloading=true
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - Got a list of count=0 added, modified, or removed indexes
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - Reloading index config: shutdown subordinate threads, now restarting
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - Initializing indexes took usec=2 reloading=true indexes_initialized=0
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - request state change from=RECONFIGURING to=RUN
02-14-2020 20:43:15.382 +0000 INFO IndexProcessor - reloading index config: end

[brdr]

So, i guess the question is, what indexes.conf is the reload looking at, as it is clearly not looking at our local indexes.conf which is in a separate custom app etc/apps/prod_indexes/local/indexes.conf.

[arjunpkishore5]

can you run btool to check if the new index is visible ?

[brdr]

it is visible via btool as soon as i add an index to our indexes.conf

[woodcock]

I think that it should work but the way that I would deploy this is:
Update indexes.conf on each indexer.
Hit the REST endpoint on eachIndexer.
Update indexes.conf on Search Head.
Hit the REST endpoint on the Search Head.
I would expect that to work.
If not, try the full debug/refresh endpoint.

[brdr]

No dice. The commands work fine, i can see entries in the splunkd.log that the commands are hitting the endpoint but, when i go into the GUI -> Settings -> Indexes the new index is NOT there.

[woodcock]

Time to open another support case.

[brdr]

Note that I am using the admin user.

[isoutamo]

If I recall right you could not see the index before it has any data.

R. Ismo