Updating eventgen.conf requires a Splunk restart

[newportknight]

Hi,

I am playing around with SA-Eventgen to generate data in a Dev environment but I find if I make a change to the eventgen.conf file I have to restart Splunk for it to take effect. (All I am doing is changing the date/time format)

Is there any other way to to make the change effective without having to carry out a restart? I have tried disabling and re-enabling via the Data input and also disabling and re-enabling the app itself but neither have the desired outcome.

Appreciate any help.

Cheers.

Paul.

[newportknight]

Hi,

Thanks for replying.

I've tried using the URL suggested but it doesn't appear to have any effect.
There are no errors showing when I carry out a search using index="_internal" sourcetype="eventgen*"

Cheers.

Paul.

[kamlesh_vaghela]

@newportknight

Is that any Errors in eventgen logs? Please execute below search for the eventgen log if you can found anything helpful.

index="_internal" sourcetype="eventgen*"

[zahrasidhpuri]

Hey Paul,
You can try doing this: http[s]://[splunkweb hostname]:[splunkweb port]/debug/refresh