Monitoring Splunk

How to get Splunk aware of the changes in inputs.conf of an app without restarting Splunk?

Nicholas_Key
Splunk Employee
Splunk Employee

Hi all,

I've been searching high and low to understand how to get Splunk aware of the changes in inputs.conf of an app and then make use of the newly changed settings without restarting Splunk.

I want to have my configuration process similar to the UNIX and Wndows app (in which I check or uncheck the checkboxes and modify the poll intervals and I do not need to restart Splunk instance in order to have the changes in inputs.conf take effect)

This is the most related documentation I could find (but not useful enough):

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

You may find a very brief one-liner description "To add new inputs without restarting Splunk, use Splunk Web..."

I have restmap.conf in my app folder with the following stanza:

[admin_external:websphereapp]
handlertype = python
handlerfile = WebSphereApp_python_handler.py
handleractions = list, edit

And I have defined three method subclassed from MConfigHandler, namely

def setup(self)
def handleList(self, confInfo)
def handleEdit(self, confInfo)

I looked at admin.py and found (not sure if I'm looking at the correct things)

self.shouldReload = false
def handleReload(self, confInfo)

How should I define the handleReload method (so that I do not need to restart Splunk instance in order to have the changes in inputs.conf take effect)?

Thanks!

Nicholas

Tags (1)
1 Solution

amrit
Splunk Employee
Splunk Employee

You don't actually need to define the handleReload method yourself. In the part of your handler that makes changes to inputs.conf, you just need to call the reload method for the particular input type that you're modifying.

For example, if you added monitor:// stanzas to inputs.conf, simple make a GET request to /services/data/inputs/monitor/_reload. The _reload action is supported by all data inputs - if you look under /services/data/inputs, you can see which are available.

View solution in original post

Nicholas_Key
Splunk Employee
Splunk Employee

I'm thinking of using self.shouldReload=true in the handleEdit method and then call handleReload method at the end of the handleEdit definition

0 Karma

amrit
Splunk Employee
Splunk Employee

You don't actually need to define the handleReload method yourself. In the part of your handler that makes changes to inputs.conf, you just need to call the reload method for the particular input type that you're modifying.

For example, if you added monitor:// stanzas to inputs.conf, simple make a GET request to /services/data/inputs/monitor/_reload. The _reload action is supported by all data inputs - if you look under /services/data/inputs, you can see which are available.

Nicholas_Key
Splunk Employee
Splunk Employee

Thanks, I'll try this out 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...