Getting Data In

reload transforms.conf

gcusello
Legend

Hi at all,
a very quick answer:
I modified transforms.conf in one app without restarting Splunk:
The update I performed was to add three new fields in a FIELDS row after DELIM:

[my_transform]
DELIM = "|"
FIELDS = "field1","field2","newfield1",newfield2","newfield3"

The strange behavior (but maybe I didn't understand it) is that my search sees the new fields without any Splunk restart and if I remove the new fields, my search doesn't see them!
It seems that transforms.conf is reading every time at search time.

Can anyone confirm this and/or explain this behavior?

Bye.
Giuseppe

0 Karma
1 Solution

493669
Super Champion

Hi @cusello,
Each time you run a search Splunk will fork off a new process and reload the props and transforms as part of that - for any search time changes. So, Settings that apply to search-time processing take effect immediately and do not require a restart.
In addition, index-time props and transforms do not require restarts, as long as your indexers are receiving the data from forwarders.
reference: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfilechangesthatrequirerestart

View solution in original post

0 Karma

493669
Super Champion

Hi @cusello,
Each time you run a search Splunk will fork off a new process and reload the props and transforms as part of that - for any search time changes. So, Settings that apply to search-time processing take effect immediately and do not require a restart.
In addition, index-time props and transforms do not require restarts, as long as your indexers are receiving the data from forwarders.
reference: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfilechangesthatrequirerestart

0 Karma

FrankVl
Ultra Champion

That is expected behavior. There are plenty of config changes that you can make which do not require splunk to be restarted.

For details, see: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfilechangesthatrequirerestart

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...