I am taking a stab at answering my own question, but a more definitive answer would be better! Heuristic 1: Any changes made by editing .conf files directly will require a restart. Exception: changes to search-time field extractions in props.conf do not require a restart Exception: .conf files for lookup tables, tags and eventtypes are also re-read for each search, so no restart is needed Exception: changing the CSS does not require a restart (just click the Splunk logo to reload) Heuristic 2: Any changes that affect indexing, in general, will require a Splunk restart. Exception: Adding a new input via the Splunk Manager (web interface) or CLI does not require a restart Exception: Adding a new index via the Splunk Manager (web interface) or CLI does not require a restart Heuristic 3. Any changes to server state, in general, will require a Splunk restart. Examples that require a restart: Changes to general indexer settings (minimum free disk space, default server name, etc.) Changes to General Settings (eg., port settings) Changing a forwarder's output settings Changing the timezone in the OS of a splunk server (Splunk retrieves its local timezone from the underlying OS at startup) ___ #### Other changes that require a restart Creating a pool of search heads Removing an input Enabling SSL for Splunk Web access (you really only need to restart splunkweb) Installing an Enterprise license for the first time on a license master Installing some apps (not all) ___ If you make changes using the Splunk Manager in the web interface, you will reduce the restarts needed. This is because the Manager will both update the underlying configuration file(s) and notify the running Splunk instance (splunkd) of the changes. ... View more

As "rotten" mentioned, once the data has been indexed, it cannot be changed. However, some things are not stored in the index. Those things can be changed as you wish. Below are the basics; look in the documentation for more details. Changes to inputs.conf change how all new data will be indexed. These changes do not affect data that has already been indexed. If you want these changes to apply to all data, you will need to use the splunk clean command, as was shown in one of the other answers. Changes to props.conf may change how data is indexed: Setting the source, sourcetype or host - these affect how the data is indexed. Therefore, this is the same as changes to inputs.conf. Defining field extractions - field definitions are not indexed; fields are built during the search process. These changes do not require that you restart Splunk. Any changes that you make to field extractions will apply to all data, regardless of when it was indexed. (BTW, you can do "index time field extractions" but don't. Use the normal, search-time field extractions - this is what Splunk recommends.) If you are new to Splunk, I suggest that you use the web interface (the Splunk Manager) to set up your inputs, and the interactive field extractor to set up your fields. One of the nice things about using the Splunk web interface is that it will tell you if you need to restart Splunk. ... View more

Excellent point. Why protect it dynamically if any person who downloads it can just look at the static files... ... View more

You made me laugh. ... View more

I see the distinction. At some point, I might want to do both... Thanks for the answer. ... View more

I am not using UDP, but this still answered my question. I need to set up the syslog server to do the DNS lookup. ... View more

For people who like books, I suggest SAM's Teach Yourself Regular Expressions in 10 Minutes (Ben Forta) It is reviewed on the regular-expressions info site http://www.regular-expressions.info/book10mins.html ... View more

Lamar, do you really need the (?m) in your regex? I think it might work just as well without it. ... View more

It does appear that the (?m) syntax should be supported by Splunk. But I am unclear why you need it in this search. If you are searching for "something" followed by "POST" followed by "something" followed by "Can't read the image!" then I think you could use host=dev* | regex _raw=".*POST.*Can't read the image!.*" If you want the exact string *POST*Can't read the image!* then you can search for host=dev* | regex _raw="\*POST\*Can't read the image!\*" ... View more

Do you want Splunk to create one event per file, or do you want it to create one event per line? ... View more

To change the way the *NIX app indexes its inputs Make a copy of inputs.conf in the local directory for the *NIX app. You may need to create the directory first. cp $SPLUNK_HOME/etc/apps/unix/default/inputs.conf $SPLUNK_HOME/etc/apps/unix/local/ Edit the copy of inputs.conf in the local directory as follows: For each stanza, remove all the lines EXCEPT index = os and disabled Change index = os to index = main (or any existing index of your choice) Make sure that disabled is set to false (or zero) Example: [monitor:///var/log] _whitelist=(\.log|log$|messages$|mesg$|cron$|acpid$|\.out) _blacklist=(lastlog) index=os disabled = 1 Would become [monitor:///var/log] index=main disabled = false You can also do this via the Splunk Manager GUI Change the *NIX eventtypes and saved searches There are a number of eventtypes and saved searches that are provided with the *NIX app. Some of them contain "index=os" as part of their search. You can simply remove this term from the search, and Splunk will search all indexes that are visible to the user. You can do this via the Splunk Manager GUI. It is probably better to use the "clone" mechanism to create a custom version of each of the redefined eventtypes, so that your changes are not overwritten by subsequent Splunk releases. ... View more

Can you provide the sourcetype of the data you are trying to search? Otherwise, there is no way to know the name of the field. Thanks! ... View more

What sourcetype are you searching? ... View more

Before you uninstall Splunk, you should stop it. You should also disable the automatic start at boot time (if you previously set it). Note that the $SPLUNK_HOME variable refers to the directory where you installed Splunk. $SPLUNK_HOME/bin/splunk stop # The following command must be run as root $SPLUNK_HOME/bin/splunk disable boot-start # Now you can remove the Splunk installation rm -rf $SPLUNK_HOME If you created any indexes and did not use the Splunk default path, you will need to delete those directories as well. If you created any user or group for running Splunk, you may also want to delete them. These instructions should work for any Linux/Unix installation - assuming that you did not use a package install. ... View more

Excellent advice. Given the environment that evoked the original post, the answer to the question "Do you have IIS6..." is probably "all of the above" Thanks very much for explaining the issue thoroughly. ... View more