how to load an edited props.conf?

[peterweinstein]

Hi,

I'm just starting to work with Splunk. I am trying to change the definition of events in an input file by editing the props.conf file in the etc/local directory. Unfortunately my edits are having no effect. I have tried:

-- Adding "| extract reload=true" to the end of the active search operating on the input file

-- Restarting Splunk with Manager/Restart from the web interface.

One odd thing worth mentioning: when I first tried to save a modified props.conf file, I had to manually alter the Windows permissions to let myself write the file.

So my question is, what is the normal development procedure for testing and updating changes to event definitions? Is there a setting somewhere else that I need to modify so manually edited changes take effect?

To learn Splunk I installed it on my Windows laptop. I'm running the free version almost fresh out of the box at this point.

Thanks for your help,
Peter

[kristian_kolb · Accepted solution]

It depends on what you are editing in props.conf. If there is anything that has to do with linebreaking, timestamping etc that happen at index time, you need to restart the splunkd service.

If it is settings regarding search time eventtype definitions or field extractions a | extract reload=t should work fine.

However, it must be the first and only thing entered in the search box. So the search starts with a pipe.

As for the permissions, it will depend on how you installed it. Unfortunately it is not as easily understood as in *nix

Hope this helps,

Kristian