Splunk Search

how to load an edited props.conf?

peterweinstein
Explorer

Hi,

I'm just starting to work with Splunk. I am trying to change the definition of events in an input file by editing the props.conf file in the etc/local directory. Unfortunately my edits are having no effect. I have tried:

-- Adding "| extract reload=true" to the end of the active search operating on the input file

-- Restarting Splunk with Manager/Restart from the web interface.

One odd thing worth mentioning: when I first tried to save a modified props.conf file, I had to manually alter the Windows permissions to let myself write the file.

So my question is, what is the normal development procedure for testing and updating changes to event definitions? Is there a setting somewhere else that I need to modify so manually edited changes take effect?

To learn Splunk I installed it on my Windows laptop. I'm running the free version almost fresh out of the box at this point.

Thanks for your help,
Peter

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

It depends on what you are editing in props.conf. If there is anything that has to do with linebreaking, timestamping etc that happen at index time, you need to restart the splunkd service.

If it is settings regarding search time eventtype definitions or field extractions a | extract reload=t should work fine.

However, it must be the first and only thing entered in the search box. So the search starts with a pipe.

As for the permissions, it will depend on how you installed it. Unfortunately it is not as easily understood as in *nix

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

It depends on what you are editing in props.conf. If there is anything that has to do with linebreaking, timestamping etc that happen at index time, you need to restart the splunkd service.

If it is settings regarding search time eventtype definitions or field extractions a | extract reload=t should work fine.

However, it must be the first and only thing entered in the search box. So the search starts with a pipe.

As for the permissions, it will depend on how you installed it. Unfortunately it is not as easily understood as in *nix

Hope this helps,

Kristian

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...