Can you refresh or reload index-time sourcetype properties without restarting Splunk?

[gkanapathy]

When you make changes to search-time extractions and other props.conf/transforms.conf settings, they can take effect right away without restarting any Splunk servers. (It's unclear to me if it happens automatically, and if so, how quickly, but it can always be forced with the | extract reload=true command.)

However, this does not seem to occur with index-time properties, such as line-breaking/line-merging rules, timestamp rules, etc. Is there a way (perhaps via a REST endpoint call) to make a Splunk indexer refresh index-time properties and rules, either globally or per-app?

[gavin1_davenpor]

Bump. I would love to be able to reload props/transforms on an indexer without having to restart it.
Is this possible yet (from the cli, preferably)....?

Gavin

[jrodman]

There's currently no app contextualiziation for index-time operations (through 4.1, probably also for 4.2). But that's aside from the fact that there's currently no reload ability.

[Ledion_Bitincka · Accepted solution]

search time extractions take effect immediately because each search reloads the configs

there is currently no way to reload the index time properties without a restart

[Ayn]

Has there been any changes to this? Any inofficial, internal REST endpoints that provide this functionality?

[dleung]

Is there a way to trigger a restart alert message to the user? Perhaps similar behavior to enabling/disabling apps. Possibly something in the EAI I can post to? By the way, I'm trying to do this from setup.xml process, so it will be convenient to do so from there.

Thanks, Danny