Security

List the entities that can be refreshed in splunkweb by hitting the /debug/refresh endpoint

ma_anand1984
Contributor

I know we can refresh different entities like the following.
Is there any link where i can all the entities available?

http://splunkserver:8000/en-US/debug/refresh?entity=

Tags (3)
1 Solution

hexx
Splunk Employee
Splunk Employee

Actually, if you hit

http[s]://[splunkweb hostname]:[splunkweb port]/debug/refresh

...you will not only refresh all available entities, but you will also be presented with a list of those entities.

View solution in original post

santiagoaloi
Path Finder

Pretty cool TA that reloads Splunk config like using the URL debug/refresh by creating a " | refresh" command.

https://splunkbase.splunk.com/app/1871/

it will also display a list of the reloaded endpoint and the status, where status=200 means success.

0 Karma

hexx
Splunk Employee
Splunk Employee

Actually, if you hit

http[s]://[splunkweb hostname]:[splunkweb port]/debug/refresh

...you will not only refresh all available entities, but you will also be presented with a list of those entities.

bwooden
Splunk Employee
Splunk Employee

I've seen timeouts when SSO is in play. If you're using SSO or have otherwise modified your root_endpoint, you'll need to adjust the URL to include your custom root endpoint.

0 Karma

vsingla1
Communicator

Just to add this, you can refresh the entitities without explicitly hitting the endpoint, you can do so by CLI from the below command:
curl -u admin: -X POST http://:8089/servicesNS/-/-/admin/transforms-reload/_reload

above is an example of reloading the transforms entity, but in a similar way, you can do reload for other entities as well.

a list of all entities is as below:

Refreshing admin/conf-times OK
Refreshing data/ui/manager OK
Refreshing data/ui/nav OK
Refreshing data/ui/views OK
Refreshing admin/alert_actions OK
Refreshing admin/applicense SplunkdConnectionException Splunkd daemon is not responding: ("Error connecting to /servicesNS/nobody/search/admin/applicense/_reload: ('The read operation timed out',)",)
Refreshing admin/clusterconfig OK
Refreshing admin/collections-conf OK
Refreshing admin/commandsconf OK
Refreshing admin/conf-checklist OK
Refreshing admin/conf-deploymentclient OK
Refreshing admin/conf-inputs OK
Refreshing admin/conf-times OK
Refreshing admin/conf-wmi OK
Refreshing admin/cooked OK
Refreshing admin/crl ResourceNotFound Invalid action for this internal handler (handler: crl, supported: list|_reload, wanted: list).
Refreshing admin/datamodel-files OK
Refreshing admin/datamodelacceleration OK
Refreshing admin/datamodeledit OK
Refreshing admin/dataset_consolidation_datamodeleditOK
Refreshing admin/deploymentserver OK
Refreshing admin/distsearch-peer OK
Refreshing admin/eventtypes OK
Refreshing admin/fields OK
Refreshing admin/fifo OK
Refreshing admin/fvtags OK
Refreshing admin/http OK
Refreshing admin/indexer-discovery-configOK
Refreshing admin/indexes OK
Refreshing admin/limits OK
Refreshing admin/livetail OK
Refreshing admin/localapps OK
Refreshing admin/lookup-table-files OK
Refreshing admin/macros OK
Refreshing admin/manager OK
Refreshing admin/messages-conf OK
Refreshing admin/modalerts OK
Refreshing admin/monitor OK
Refreshing admin/nav OK
Refreshing admin/panels OK
Refreshing admin/passwords OK
Refreshing admin/pools OK
Refreshing admin/proxysettings OK
Refreshing admin/quickstart OK
Refreshing admin/raw OK
Refreshing admin/remote_eventlogs OK
Refreshing admin/remote_indexes BadRequest The following required arguments are missing: repositoryLocation.
Refreshing admin/remote_monitor OK
Refreshing admin/remote_perfmon OK
Refreshing admin/remote_raw OK
Refreshing admin/remote_script OK
Refreshing admin/remote_udp OK
Refreshing admin/savedsearch OK
Refreshing admin/scheduledviews OK
Refreshing admin/script OK
Refreshing admin/search-head-bundles OK
Refreshing admin/serverclasses OK
Refreshing admin/shclusterconfig OK
Refreshing admin/sourcetypes OK
Refreshing admin/splunktcptoken OK
Refreshing admin/ssl OK
Refreshing admin/syslog OK
Refreshing admin/tcpout-default OK
Refreshing admin/tcpout-group OK
Refreshing admin/tcpout-server OK
Refreshing admin/telemetry OK
Refreshing admin/transforms-extract OK
Refreshing admin/transforms-lookup OK
Refreshing admin/transforms-reload OK
Refreshing admin/udp OK
Refreshing admin/ui-prefs OK
Refreshing admin/ui-tour OK
Refreshing admin/views OK
Refreshing admin/viewstates OK
Refreshing admin/vix-indexes OK
Refreshing admin/vix-providers OK
Refreshing admin/workflow-actions OK
DONE

0 Karma

hexx
Splunk Employee
Splunk Employee

This is abnormal behavior and possibly the sign that something is wrong with your instance. If all you want to get is the list of refreshable entities, I would suggest to hit that endpoint on another, healthier instance.

0 Karma

ma_anand1984
Contributor

@HEXX when i tried this url, http[s]://[splunkweb hostname]:[splunkweb port]/debug/refresh

it gets timed out every time i tried. Is there any other way , i can get the list of entities? like "admin/auth-services"

hexx
Splunk Employee
Splunk Employee

You are probably looking for http[s]://[splunkweb hostname]:[splunkweb port]/info.

rmorlen
Splunk Employee
Splunk Employee

Is there a list of all the debug commands? I know you can do /debug/sso to show info on single signon.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...