Can I debug/refresh Splunk Cloud env. or manage Splunk Cloud change via ACS without a Splunkd restart?

[pstein]

Two part question:

1) If I complete an individually owned App upgrade to our Victoria environment through the use of "Install App From File" which changes a props.conf setting, can I run a "debug/refresh" to reload the Splunk Cloud configs? 

2) Or, if I manage the App change through ACS CLI to edit_local_apps

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Config/RBAC

Upgrade app (Victoria)

PATCH

apps/victoria/{app}

edit_local_apps AND install_apps

will my change circumnavigate a restart of the environment, and reload the configs simply by the use of ACS CLI?

[pstein]

Thanks, Mattymo. Knowing debug/reload helps.

As I dug into your link and followed the link string to investigate further about REST API call, in this case using CURL, I found this tidbit:
"As a Splunk Cloud Platform user, you are restricted to interacting with the search tier only with the REST API."
Appears like my hands are tied when trying to find a non-restart solution similar to "debug/reload" like we enjoy onPrem.

[mattymo]

I wouldn't give up yet...we have a lot of behind the scenes logic that takes care of distributing your configs in cloud and reducing the need for restarts, and the _reload option is available in cloud...are you certain you need a refresh? Generally props, i dont believe should require them anymore...

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Admin/RollingRestart#Reload_or_restart_be...

https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Configurationfilechangesthatrequirerestart#...

are you hitting some sort of issue or error?

I can always test your app in my stack if you want...

[pstein]

No. At this point I'm not hitting a hurdle or error, but trying to do upfront work in determining whether there's a method of reloading without causing a restart after installing an App "from a file". We don't want an unexpected request for restart in order to complete the installation, and impact our customers uptime. But if challenged with a request to restart could turn to a 'reload' option.

In my immediate scenario, in our Victoria environment, I recently upgraded a self built app from v1.0.0 to version 1.0.1 during a maintenance window to fix an issue . The change was mostly correct, but now I need to tweak my App to pickup the correct timestamp, and my next available maintenance window is next Monday night. All I'm modifying is "MAX_TIMESTAMP_LOOKAHEAD" in props.conf  from 50 to 100.
I've been instructed to find a possible method to run a reload after the upgrade instead of a possible restart. 

If there isn't a way to 'reload' vs. 'restart' in the Cloud, that's ok. I just need to know so we can stay within our Maintenance Window.

[mattymo]

I think it will just use reload. will try and replicate in my stack when i get the chance and let you know. Docs say it should just be a reload automagically for props/tranforms changes. 

[pstein]

Thought I would just check in to see if you had any luck attempting in your stack. Unfortunately, I don't have a lab Cloud stack to attempt this myself. I appreciate your help.

[mattymo]

Not yet, sorry, will have to try next week. 

[pstein]

Found this very accurate list of reload/restart config changes, and when each will be enacted.

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Admin/RollingRestart?_ga=2.153172536.1431...

I think this answers my own question and aligns with what you previously mentioned.

Thank you for your help, @mattymo

[mattymo]

Yeah, I linked that in my original answer. Let us know when you try and how it goes!

[mattymo]

I don't believe you can run /debug/refresh in cloud, at least not how I tried it 

https://stackname .splunkcloud.com/en-US/debug/refresh

That being said restarts aren't needed for much anymore these days. Are you certain you need to or is it habit?

can you achieve what you need with the _reload endpoint instead?

https://docs.splunk.com/Documentation/Splunk/9.0.4/RESTUM/RESTusing#Reload_endpoint