Deployment Architecture

Splunk configuration changes - SIGHUP or restart?

araitz
Splunk Employee
Splunk Employee

Sometimes I make changes to my Splunk server's configuration, but I do not want to restart Splunk.

Which configuration changes require a restart, and which do not?

Also, does Splunk support a SIGHUP on linux/unix systems?

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

In general, settings which affect search take effect immediately, since searches are run in a separate process that reloads configurations. These settings include lookup tables, field extractions, tags and eventtypes.

Settings which affect indexing usually require a restart. These include index time field extractions, timestamp properties and index creation.

Input settings made through the UI and CLI do not require restarts and take place immediately.

Splunk doesn't yet support SIGHUP on unix systems, but that is certainly a commonly desired feature.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

In general, settings which affect search take effect immediately, since searches are run in a separate process that reloads configurations. These settings include lookup tables, field extractions, tags and eventtypes.

Settings which affect indexing usually require a restart. These include index time field extractions, timestamp properties and index creation.

Input settings made through the UI and CLI do not require restarts and take place immediately.

Splunk doesn't yet support SIGHUP on unix systems, but that is certainly a commonly desired feature.

jrodman
Splunk Employee
Splunk Employee

Heehee sending splunk a SIGHUP causes it to shut down. So you probably don't want to do this.

Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...