Why is indexes.conf change not reflected in GUI without restart?

[jankowsr]

I use Splunk Enterprise 8.0.4.1

In indexes.conf I have changed maxTotalDataSizeMB value.

According to https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Determinerestart that kind of change should not require splunk restart. Anyway I can't see the change in GUI https://my_splunk/en-US/manager/launcher/data/indexes without doing splunk restart. Any clue why is it like that?

[PickleRick]

I assume you're using an all-in-one installation.

In a bigger setup you'd normally not even be able to see the indexes defined on your indexers by clicking on the search-heads (the search-heads can have their own indexes if they're not configured according to good-practices to send the events to indexers).

So I'd assume it's not as much a "bug" as a "misfeature". It's simply that the change to the indexes.conf is being picked up by the indexing part of the splunk daemon but since it's not being done from UI, the "search head" part of the daemon is not aware of this. It happens with other parts of the config too - if they're done in UI, the UI takes care of refreshing the config and keeping things consistent. If they're done manually by fiddling with the conf files, the UI might not catch-up immediately on the changes.

[isoutamo · Accepted solution]

Hi

at least in some cases when you are using some REST queries those didn't work correctly before restarts (some volume/index sizes if I recall right). This is probably some kind of bug?

One thing what you can try is using http(s)://<your splunk>(<:port>)/debug/refresh. Try to reload and check if it helps. If not then you probably needs a restart.

r. Ismo

[jankowsr]

Thank you, the link you provided did the job.

It's still not clear to me if this is needed because of any kind of bug but at least restart is not needed.