Reporting

Reloading savedsearches for given app

althomas
Communicator

Hi all,

Previously we used to use the endpoint /servicesNS/nobody/my_app_name/admin/savedsearch/_reload to reload savedsearches while the search head was online.

Since moving to Splunk 8, this endpoint does nothing. Searches are still running if I set disabled=1 manually in the config, yet the endpoint returns a 200 OK, as below:

/opt/splunk//bin/splunk _internal call /servicesNS/-/-/admin/savedsearch/_reload -user admin
QUERYING: 'https://127.0.0.1:8089/servicesNS/-/-/admin/savedsearch/_reload'
HTTP Status: 200.
Content:
<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>savedsearch</title>
<id>https://127.0.0.1:8089/servicesNS/-/-/admin/savedsearch</id>
<updated>2021-04-15T11:22:04+02:00</updated>
<generator build="63079c59e632" version="8.1.3"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/-/-/admin/savedsearch/_new" rel="create"/>
<link href="/servicesNS/-/-/admin/savedsearch/_reload" rel="_reload"/>
<link href="/servicesNS/-/-/admin/savedsearch/_acl" rel="_acl"/>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
</feed>

 

Has this changed? Are we not able to manually hit this endpoint anymore? 

We can still hit https://localhost:8089/en-GB/debug/refresh to reload all entities (specifying entity=admin/savedsearch doesn't seem to work either), but this can time out on behemoth search heads and leaves us having to restart the search head if the config is not applying.

Is there anything we can do about this? How do we trigger a manual reload of the savedsearch config in Splunk 8?

Thanks!
Kind regards,
Alex

Labels (1)
0 Karma
1 Solution

althomas
Communicator

Thanks for reminding me that I still had this open. This is fixed in version 8.1.4.  I escalated to support.

 

that this specific behavior matches our internal case SPL-203763 "savedsearches.conf is not updated after upgrading to 8.1.0 because REST API endpoint is not reloaded". It has been now fixed on Splunk version 8.1.4. Please let me know if I can be of any further assistance.




View solution in original post

0 Karma

althomas
Communicator

As far as I can tell, this is a bug.

Documentation: https://docs.splunk.com/Documentation/Splunk/8.1.3/RESTUM/RESTusing#Reload_endpoint
Excerpt:

Reload endpoint

Append _reload to a URL to force the server to reload data for the endpoint:

curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/saved/searches/_reload

You can use _reload for all saved searches but not for a single saved search.

If we run this:

 

curl -k -u admin https://localhost:8089/servicesNS/nobody/search/saved/searches/_reload
Enter host password for user 'admin':
<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>savedsearch</title>
  <id>https://localhost:8089/servicesNS/nobody/search/saved/searches</id>
  <updated>2021-04-15T12:56:45+02:00</updated>
  <generator build="63079c59e632" version="8.1.3"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/servicesNS/nobody/search/saved/searches/_new" rel="create"/>
  <link href="/servicesNS/nobody/search/saved/searches/_reload" rel="_reload"/>
  <link href="/servicesNS/nobody/search/saved/searches/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

 


we get a 200/OK but still no update

Tags (1)

morawi5
Explorer

Any update on this? We can't manually hit this one and have it update either.

Tags (1)
0 Karma

althomas
Communicator

Thanks for reminding me that I still had this open. This is fixed in version 8.1.4.  I escalated to support.

 

that this specific behavior matches our internal case SPL-203763 "savedsearches.conf is not updated after upgrading to 8.1.0 because REST API endpoint is not reloaded". It has been now fixed on Splunk version 8.1.4. Please let me know if I can be of any further assistance.




View solution in original post

0 Karma

morawi5
Explorer

Workaround below:

Use endpoint /servicesNS/nobody/<app_name>/admin/localapps/_reload  with GET request

Tags (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!