Monitoring Splunk

How to get Splunk aware of the changes in inputs.conf of an app without restarting Splunk?

Nicholas_Key
Splunk Employee
Splunk Employee

Hi all,

I've been searching high and low to understand how to get Splunk aware of the changes in inputs.conf of an app and then make use of the newly changed settings without restarting Splunk.

I want to have my configuration process similar to the UNIX and Wndows app (in which I check or uncheck the checkboxes and modify the poll intervals and I do not need to restart Splunk instance in order to have the changes in inputs.conf take effect)

This is the most related documentation I could find (but not useful enough):

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

You may find a very brief one-liner description "To add new inputs without restarting Splunk, use Splunk Web..."

I have restmap.conf in my app folder with the following stanza:

[admin_external:websphereapp]
handlertype = python
handlerfile = WebSphereApp_python_handler.py
handleractions = list, edit

And I have defined three method subclassed from MConfigHandler, namely

def setup(self)
def handleList(self, confInfo)
def handleEdit(self, confInfo)

I looked at admin.py and found (not sure if I'm looking at the correct things)

self.shouldReload = false
def handleReload(self, confInfo)

How should I define the handleReload method (so that I do not need to restart Splunk instance in order to have the changes in inputs.conf take effect)?

Thanks!

Nicholas

Tags (1)
1 Solution

amrit
Splunk Employee
Splunk Employee

You don't actually need to define the handleReload method yourself. In the part of your handler that makes changes to inputs.conf, you just need to call the reload method for the particular input type that you're modifying.

For example, if you added monitor:// stanzas to inputs.conf, simple make a GET request to /services/data/inputs/monitor/_reload. The _reload action is supported by all data inputs - if you look under /services/data/inputs, you can see which are available.

View solution in original post

Nicholas_Key
Splunk Employee
Splunk Employee

I'm thinking of using self.shouldReload=true in the handleEdit method and then call handleReload method at the end of the handleEdit definition

0 Karma

amrit
Splunk Employee
Splunk Employee

You don't actually need to define the handleReload method yourself. In the part of your handler that makes changes to inputs.conf, you just need to call the reload method for the particular input type that you're modifying.

For example, if you added monitor:// stanzas to inputs.conf, simple make a GET request to /services/data/inputs/monitor/_reload. The _reload action is supported by all data inputs - if you look under /services/data/inputs, you can see which are available.

Nicholas_Key
Splunk Employee
Splunk Employee

Thanks, I'll try this out 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...