Splunk Search

Can you refresh or reload index-time sourcetype properties without restarting Splunk?

gkanapathy
Splunk Employee
Splunk Employee

When you make changes to search-time extractions and other props.conf/transforms.conf settings, they can take effect right away without restarting any Splunk servers. (It's unclear to me if it happens automatically, and if so, how quickly, but it can always be forced with the | extract reload=true command.)

However, this does not seem to occur with index-time properties, such as line-breaking/line-merging rules, timestamp rules, etc. Is there a way (perhaps via a REST endpoint call) to make a Splunk indexer refresh index-time properties and rules, either globally or per-app?

1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

search time extractions take effect immediately because each search reloads the configs

there is currently no way to reload the index time properties without a restart

View solution in original post

gavin1_davenpor
Path Finder

Bump. I would love to be able to reload props/transforms on an indexer without having to restart it.
Is this possible yet (from the cli, preferably)....?

Gavin

jrodman
Splunk Employee
Splunk Employee

There's currently no app contextualiziation for index-time operations (through 4.1, probably also for 4.2). But that's aside from the fact that there's currently no reload ability.

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

search time extractions take effect immediately because each search reloads the configs

there is currently no way to reload the index time properties without a restart

Ayn
Legend

Has there been any changes to this? Any inofficial, internal REST endpoints that provide this functionality?

0 Karma

dleung
Splunk Employee
Splunk Employee

Is there a way to trigger a restart alert message to the user? Perhaps similar behavior to enabling/disabling apps. Possibly something in the EAI I can post to? By the way, I'm trying to do this from setup.xml process, so it will be convenient to do so from there.

Thanks, Danny

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...