Getting Data In

To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

Abilan1
Path Finder

Hi ,

I wanted to modify access for a few users and also I want to modify the index. Can I make these changes from Search Head or I need to modify this from Indexer?

If I modify inputs.conf file, do I need to restart my index and search head?

Regards,
Abilan

0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

1.) Modifying access to indexes can be set on the search head. See steps 7 and 8 here.

2.) See this document for generalities about when to restart different parts of Splunk. It states:

When to restart Splunkd:
As a general rule, anything that modifies:

Settings and properties that affect indexers and indexing behavior
Settings and properties that affect users and roles.
Settings and properties that affect Splunk's core configuration.

There is a way to use reload too; but the docs state you should restart.
See these answers for more information.

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

1.) Modifying access to indexes can be set on the search head. See steps 7 and 8 here.

2.) See this document for generalities about when to restart different parts of Splunk. It states:

When to restart Splunkd:
As a general rule, anything that modifies:

Settings and properties that affect indexers and indexing behavior
Settings and properties that affect users and roles.
Settings and properties that affect Splunk's core configuration.

There is a way to use reload too; but the docs state you should restart.
See these answers for more information.

Abilan1
Path Finder

Hi Johnson,

Thank you so much for your help!

0 Karma

Abilan1
Path Finder

Hi,

I want to modify the index name. is it possible to do it from Search Head?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

I believe you can't rename it from the settings menu - you'll need to move it to the new name.

See this answer.
http://answers.splunk.com/answers/5479/how-to-rename-an-index.html

and this page:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Moveanindex

Abilan1
Path Finder

Hi Johnson,

if I want to modify the index itself, is it possible to do it from Search Head?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

What modifications do you want to make ?

There is lots of specific index management documentation here:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/HowSplunkstoresindexes#Buckets_and_Splunk_...

0 Karma

Abilan1
Path Finder

Thank you very much for your help!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...