Reloading savedsearches for given app

[althomas]

Hi all,

Previously we used to use the endpoint /servicesNS/nobody/my_app_name/admin/savedsearch/_reload to reload savedsearches while the search head was online.

Since moving to Splunk 8, this endpoint does nothing. Searches are still running if I set disabled=1 manually in the config, yet the endpoint returns a 200 OK, as below:

/opt/splunk//bin/splunk _internal call /servicesNS/-/-/admin/savedsearch/_reload -user admin
QUERYING: 'https://127.0.0.1:8089/servicesNS/-/-/admin/savedsearch/_reload'
HTTP Status: 200.
Content:
<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>savedsearch</title>
<id>https://127.0.0.1:8089/servicesNS/-/-/admin/savedsearch</id>
<updated>2021-04-15T11:22:04+02:00</updated>
<generator build="63079c59e632" version="8.1.3"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/-/-/admin/savedsearch/_new" rel="create"/>
<link href="/servicesNS/-/-/admin/savedsearch/_reload" rel="_reload"/>
<link href="/servicesNS/-/-/admin/savedsearch/_acl" rel="_acl"/>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
</feed>

Has this changed? Are we not able to manually hit this endpoint anymore? 

We can still hit https://localhost:8089/en-GB/debug/refresh to reload all entities (specifying entity=admin/savedsearch doesn't seem to work either), but this can time out on behemoth search heads and leaves us having to restart the search head if the config is not applying.

Is there anything we can do about this? How do we trigger a manual reload of the savedsearch config in Splunk 8?

Thanks!
Kind regards,
Alex

[althomas]

As far as I can tell, this is a bug.

Documentation: https://docs.splunk.com/Documentation/Splunk/8.1.3/RESTUM/RESTusing#Reload_endpoint
Excerpt:

Reload endpoint

Append _reload to a URL to force the server to reload data for the endpoint:

curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/saved/searches/_reload

You can use _reload for all saved searches but not for a single saved search.

If we run this:

curl -k -u admin https://localhost:8089/servicesNS/nobody/search/saved/searches/_reload
Enter host password for user 'admin':
<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>savedsearch</title>
  <id>https://localhost:8089/servicesNS/nobody/search/saved/searches</id>
  <updated>2021-04-15T12:56:45+02:00</updated>
  <generator build="63079c59e632" version="8.1.3"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/servicesNS/nobody/search/saved/searches/_new" rel="create"/>
  <link href="/servicesNS/nobody/search/saved/searches/_reload" rel="_reload"/>
  <link href="/servicesNS/nobody/search/saved/searches/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

we get a 200/OK but still no update

[morawi5]

Any update on this? We can't manually hit this one and have it update either.

[althomas · Accepted solution]

Thanks for reminding me that I still had this open. This is fixed in version 8.1.4.  I escalated to support.

that this specific behavior matches our internal case SPL-203763 "savedsearches.conf is not updated after upgrading to 8.1.0 because REST API endpoint is not reloaded". It has been now fixed on Splunk version 8.1.4. Please let me know if I can be of any further assistance.

---

[morawi5]

Workaround below:

Use endpoint /servicesNS/nobody/<app_name>/admin/localapps/_reload  with GET request