Getting Data In

To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

Path Finder

Hi ,

I wanted to modify access for a few users and also I want to modify the index. Can I make these changes from Search Head or I need to modify this from Indexer?

If I modify inputs.conf file, do I need to restart my index and search head?

Regards,
Abilan

0 Karma
1 Solution

Splunk Employee
Splunk Employee

1.) Modifying access to indexes can be set on the search head. See steps 7 and 8 here.

2.) See this document for generalities about when to restart different parts of Splunk. It states:

When to restart Splunkd:
As a general rule, anything that modifies:

Settings and properties that affect indexers and indexing behavior
Settings and properties that affect users and roles.
Settings and properties that affect Splunk's core configuration.

There is a way to use reload too; but the docs state you should restart.
See these answers for more information.

View solution in original post

Splunk Employee
Splunk Employee

1.) Modifying access to indexes can be set on the search head. See steps 7 and 8 here.

2.) See this document for generalities about when to restart different parts of Splunk. It states:

When to restart Splunkd:
As a general rule, anything that modifies:

Settings and properties that affect indexers and indexing behavior
Settings and properties that affect users and roles.
Settings and properties that affect Splunk's core configuration.

There is a way to use reload too; but the docs state you should restart.
See these answers for more information.

View solution in original post

Path Finder

Hi Johnson,

Thank you so much for your help!

0 Karma

Path Finder

Hi,

I want to modify the index name. is it possible to do it from Search Head?

0 Karma

Splunk Employee
Splunk Employee

I believe you can't rename it from the settings menu - you'll need to move it to the new name.

See this answer.
http://answers.splunk.com/answers/5479/how-to-rename-an-index.html

and this page:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Moveanindex

Path Finder

Hi Johnson,

if I want to modify the index itself, is it possible to do it from Search Head?

0 Karma

Splunk Employee
Splunk Employee

What modifications do you want to make ?

There is lots of specific index management documentation here:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/HowSplunkstoresindexes#Buckets_and_Splunk_...

0 Karma

Path Finder

Thank you very much for your help!

0 Karma