Getting Data In

reload transforms.conf

gcusello
Esteemed Legend

Hi at all,
a very quick answer:
I modified transforms.conf in one app without restarting Splunk:
The update I performed was to add three new fields in a FIELDS row after DELIM:

[my_transform]
DELIM = "|"
FIELDS = "field1","field2","newfield1",newfield2","newfield3"

The strange behavior (but maybe I didn't understand it) is that my search sees the new fields without any Splunk restart and if I remove the new fields, my search doesn't see them!
It seems that transforms.conf is reading every time at search time.

Can anyone confirm this and/or explain this behavior?

Bye.
Giuseppe

0 Karma
1 Solution

493669
Super Champion

Hi @cusello,
Each time you run a search Splunk will fork off a new process and reload the props and transforms as part of that - for any search time changes. So, Settings that apply to search-time processing take effect immediately and do not require a restart.
In addition, index-time props and transforms do not require restarts, as long as your indexers are receiving the data from forwarders.
reference: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfilechangesthatrequirerestart

View solution in original post

0 Karma

493669
Super Champion

Hi @cusello,
Each time you run a search Splunk will fork off a new process and reload the props and transforms as part of that - for any search time changes. So, Settings that apply to search-time processing take effect immediately and do not require a restart.
In addition, index-time props and transforms do not require restarts, as long as your indexers are receiving the data from forwarders.
reference: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfilechangesthatrequirerestart

0 Karma

FrankVl
Ultra Champion

That is expected behavior. There are plenty of config changes that you can make which do not require splunk to be restarted.

For details, see: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfilechangesthatrequirerestart

Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...