do you have to restart Splunk when you've added a custom search command?

[piebob]

if i create a custom search command as described in http://www.splunk.com/base/Documentation/latest/SearchReference/Aboutcustomsearchcommands do i have to restart Splunk before it'll work?

[npandith · Accepted solution]

If you are trying to modify the commands.conf file then you no need to restart the splunk. If you are creating a new command then you need to restart the splunk for sure.

[Lowell]

Using the "getinfo" feature does reduce the need to restart splunk for certain parameter changes. For example, streaming, generating, preop, ... are all determine within the script (which can be changed at any time since splunk launches a new copy for each search). Take a look at splunk.Intersplunk.outputInfo() for more info. This has saved me from having to restart splunk a few times, but your millage may vary.

[Genti]

i think the rule of thumb is that if it is a *.conf file that is being edited you need a Splunk restart..(?)

[gkanapathy]

Not a very accurate rule of thumb. Editing many search-time configurations (regardless of the conf file) does not require a restart of Splunk to take effect. Some do, however, notably savedsearches.conf. I believe that creating a new command in commands.conf requires a restart. However, changing the command script or commands.conf parameters for an existing command do not require a restart.