In general after we make changes in .conf files splunk instance should restart. If we deploy splunk in production environment and after making changes in .conf files a restart of entire splunk might be problem. so, is there any way we can resolve this problem?
If its just a change to a search time transforms.conf, you could use the following SPL:
| extract reload=t
If its just a change to a search time transforms.conf, you could use the following SPL:
| extract reload=t
Thanks Nickstone. but what if it was a props.conf file?
As per the props.conf documentation:
# You can enable configurations changes made to props.conf by typing the
# following search string in Splunk Web:
#
# | extract reload=T
So yes that will work for props and transforms.conf