Splunk Search

Reloading Transforms from CLI?

s6a9d6u9s
New Member

"Enable configuration changes made to transforms.conf by typing the following search in Splunk Web: | extract reload=T"

Is it possible to reload transforms.conf from the CLI? Will restarting Splunk do it if there's no CLI extract reload command?

Tags (2)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This is unnecessary and outdated documentation. transforms.conf is reloaded upon every search. Of course, if you are on an older (3.x or older) version where you need to do this, you can simply run a CLI search with that command.


Update:

If you're making index-time changes, then this doesn't work. Only for search-time configurations take effect immediately. You must generally restart splunkd for index-time changes to take effect. This is true for 4.1.x and earlier. I don't know enough about 4.2 to say for sure if that is the case.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

oh okay. If you're making index-time changes, then no. This is only for search-time configurations. You must generally restart splunkd for index-time changes to take effect. This is true for 4.1.x and earlier. I don't know enough about 4.2 to say for sure if that is the case.

0 Karma

s6a9d6u9s
New Member

i.e. splitting logs from multiple clients/environments into separate indexes like so: http://pastebin.com/J1xGX8RU

0 Karma

s6a9d6u9s
New Member

We are mainly using Transforms.conf to route raw syslog traffic specific indexes based on the source IP. So if we make changes to transforms.conf, incoming logs will immediately start being routed to the correct index too?

We're also having to update props.conf at the same time, maybe this question is moot if changing props.conf requires a restart anyway.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...