which props files in splunk do not require restarting splunk?

[alexl1]

hi, when making changes to props files, which props files in splunk do not require restarting splunk and take effect on the fly? thanks,

[ChrisG · Accepted solution]

Are you asking about props.conf in particular, or configuration files in general? Changes to props.conf almost always require a restart, see this previous Answers posting.

For a more general answer, see this Answers posting.

You should read the topics about configuration files in the Admin Manual, particularly the topic on configuration file precedence.

[ChrisG]

No, you would never be. But, if you--hypothetically--were, I would admire you for it.

[Drainy]

Not to be picky of course 🙂

[ChrisG]

Thanks for the refinement, Drainy. 🙂 I appreciate it the correction!

[Drainy]

I'd disagree that they almost always require a restart, as Ayn posted below, anything search time related takes effect immediately as this part of the props is reloaded each time Splunkd forks off a new process to handle a search.

[alacercogitatus]

It's more about the settings that are changed, then the files themselves. Search-Time properties (EXTRACT, REPORT, FIELDALIAS, etc) are done "on the fly". Index-time properties (TRANSFORMS, LINE_BREAKER, parsing items, etc) need restarts. When in doubt, wait no more than 10 minutes, and then restart.

[Ayn]

It's not a matter of which file the settings are in - Splunk reads settings from all props.conf files and merges them. Rather it's a matter of which specific settings. The general rule is that all settings affecting index-time behaviour (event breaking, timestamp parsing, etc) require a restart whereas all search-time settings (field extractions, lookups...) do not.

[alexl1]

thanks xxx