Splunk Search

Updating eventgen.conf requires a Splunk restart

newportknight
Loves-to-Learn

Hi,

I am playing around with SA-Eventgen to generate data in a Dev environment but I find if I make a change to the eventgen.conf file I have to restart Splunk for it to take effect. (All I am doing is changing the date/time format)

Is there any other way to to make the change effective without having to carry out a restart? I have tried disabling and re-enabling via the Data input and also disabling and re-enabling the app itself but neither have the desired outcome.

Appreciate any help.

Cheers.

Paul.

Tags (1)
0 Karma

newportknight
Loves-to-Learn

Hi,

Thanks for replying.

I've tried using the URL suggested but it doesn't appear to have any effect.
There are no errors showing when I carry out a search using index="_internal" sourcetype="eventgen*"

Cheers.

Paul.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@newportknight

Is that any Errors in eventgen logs? Please execute below search for the eventgen log if you can found anything helpful.

index="_internal" sourcetype="eventgen*"
0 Karma

zahrasidhpuri
Engager

Hey Paul,
You can try doing this: http[s]://[splunkweb hostname]:[splunkweb port]/debug/refresh

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...