Getting Data In

Reload realtimeoutput.conf without restarting Splunkd

areber04
Explorer

Is it possible to restart the RTO app without restarting Splunkd? We have the RTO app installed on each of our indexers to spread out the load, but bringing down Splunk for 5 minutes while it restarts just to update the output is impacting our users. I have tried using the REST API (servername:8089/services/apps/local/SplunkRealTimeOutput/_reload) but I receive a message on the indexer stating that "realtimeoutput" and "web" require a restart for the changes to take effect. I have also tried using the "enable" and "disable" REST calls, but the result is the same.

Is it possible to reload these configurations without restarting the entire indexer?

0 Karma

araitz
Splunk Employee
Splunk Employee

Real-time outputs are in part scripted inputs. Since you are familiar with the REST API, you are ahead of the game. Try POSTing to this endpoint:

 https://af-yolo.sv.splunk.com:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/your\_r...
0 Karma

areber04
Explorer

To follow up on this:
https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/_reload appears to be the right command. The "restart" command produces an error: In handler 'script': The following required arguments are missing: script.

We are continuing testing to figure out how to get the _reload command to function consistently, but initial results show it working about 75% of the time. There have been several cases where only 3 or 4 out of 6 of our RTO inputs actually reload on a given indexer.

0 Karma

araitz
Splunk Employee
Splunk Employee

Looks like there are actually two actions, both implemented at the collection layer:

 https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/_reload

 https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/restart

According to the docs, I think you want to POST to the restart endpoint.

0 Karma

areber04
Explorer

I feel like I'm closer now

curl -k -u admin https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/%252Fopt%252Fsplunk... -d ''

Enter host password for user 'admin':


  
    In handler 'script': Invalid custom action for this internal handler (handler: script, custom action: _reload, eai action: edit).

Not sure what I am missing

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...