I want to replace the existing passwd file on indexers with a new file. The only way to accomplish this is to restart the indexer. There are summary indexing scheduled searches running almost every minute. No good time window to do a restart. Is there a REST API endpoint to reload the passwd file? Is there any way to put the passwd file in place without a restart?
Not sure if this loads the passwd file, this Splunk refresh URL does refresh the authentication related changes without restart. Worth giving a try. Just launch
http://yoursplunkserver:8000/en-US/debug/refresh?entity=admin/auth-services
Already on it 🙂
For the benefit of future users searching for answers to a similar problem, please convert one of the comments to an answer and accept it.
Not sure if this loads the passwd file, this Splunk refresh URL does refresh the authentication related changes without restart. Worth giving a try. Just launch
http://yoursplunkserver:8000/en-US/debug/refresh?entity=admin/auth-services
Browsing through other answers:http://answers.splunk.com/answers/129654/how-to-i-trigger-reload-of-authentication-configuration-pro...
./splunk _internal call /authentication/providers/services/_reload -auth
from command line is a step towards the direction to scripting my intended purpose..
This worked! Although you have to sign in with an existing account in order to refresh. Thanks for this work around, no need to restart the indexers now.