To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

[Abilan1]

Hi ,

I wanted to modify access for a few users and also I want to modify the index. Can I make these changes from Search Head or I need to modify this from Indexer?

If I modify inputs.conf file, do I need to restart my index and search head?

Regards,
Abilan

[aljohnson_splun · Accepted solution]

1.) Modifying access to indexes can be set on the search head. See steps 7 and 8 here.

2.) See this document for generalities about when to restart different parts of Splunk. It states:

When to restart Splunkd:
As a general rule, anything that modifies:

Settings and properties that affect indexers and indexing behavior
Settings and properties that affect users and roles.
Settings and properties that affect Splunk's core configuration.

There is a way to use reload too; but the docs state you should restart.
See these answers for more information.

[Abilan1]

Hi Johnson,

Thank you so much for your help!

[Abilan1]

Hi,

I want to modify the index name. is it possible to do it from Search Head?

[aljohnson_splun]

I believe you can't rename it from the settings menu - you'll need to move it to the new name.

See this answer.
http://answers.splunk.com/answers/5479/how-to-rename-an-index.html

and this page:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Moveanindex

[Abilan1]

Hi Johnson,

if I want to modify the index itself, is it possible to do it from Search Head?

[aljohnson_splun]

What modifications do you want to make ?

There is lots of specific index management documentation here:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/HowSplunkstoresindexes#Buckets_and_Splunk_...

[Abilan1]

Thank you very much for your help!