Getting Data In

props.conf changes require complete restart?

FRoth
Contributor

Hi to all - short question:

Do changes to the props.conf really require a restart of splunk?
Is there a way to apply the changes without restarting?

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Yes. Per the documentation:

http://www.splunk.com/base/Documentation/latest/admin/Propsconf

To use one or more of these configurations, copy the configuration block into
props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

Yes. Per the documentation:

http://www.splunk.com/base/Documentation/latest/admin/Propsconf

To use one or more of these configurations, copy the configuration block into
props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.

markmcd
Path Finder

+1 to @Masa. This applies to props.conf changes in the user scope (e.g. etc/users/myusername/search/local/props.conf)

0 Karma

Masa
Splunk Employee
Splunk Employee

Most of the case, Yes.

However, Search time field extraction via props.conf, (and transforms.conf) does not require restarting Splunk.

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...