Getting Data In

Reload transforms.conf, props.conf and lookups

tkiss
Path Finder

Hi!

I have the habit to develope TAs and Splunk Apps right on the Splunk server. You know, 2 screens: Splunk search head web frontend on the left and notepad++ on the right screen where I have props.conf and transforms.conf opened as well as some lookup CSVs. As soon as I make a (search-time!) change in props.conf and transforms.conf I would expect Splunk to use it when I try to search on the web frontend. This has worked flawlessly with Splunk v5.x

Unfortunately this stopped or at the very least started to work very strangely with Splunk v6.x.

I've tried almost all the magic refreshes like: /debug/refresh, |extract reload=t, switching back and forth apps, trying a new search. 2 times out of 10 it works but the vast majority of my tries just seems to be "cached". It does reload the .conf files after a while (usually 1-3 minutes) but as you can imagine this painfully slows down the development of TAs.

Does anyone know a reliable way to reload simple, basic, search time field extractions stored in props.conf and transforms.conf WITHOUT restarting Splunk and which works in Splunk 6?

I'm using Splunk 6.1.4 if it matters but seen this behaviour on all Splunk version since v6.0.

Many thanks,
Tamas

1 Solution

jrodman
Splunk Employee
Splunk Employee

This isn't the answer you're looking for, so feel free not to accept. However, the general, deliberate, direction we're going in is having the searches not reload search state on every startup. This is because there's an large performance penalty which grows enormous in large environments to loading the state all the time.

That said, yes there should be a developer-friendly poke-to-reload action. I'll try to ask around when work hours come by again.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

This isn't the answer you're looking for, so feel free not to accept. However, the general, deliberate, direction we're going in is having the searches not reload search state on every startup. This is because there's an large performance penalty which grows enormous in large environments to loading the state all the time.

That said, yes there should be a developer-friendly poke-to-reload action. I'll try to ask around when work hours come by again.

dvb
Path Finder

I understand that you don't want to reload everything everytime. But why has extract reload=t stopped to work? That's something I would only add to the search when I need the configs to be reloaded!

jizzmaster
Path Finder

This poke-to-reload functionality is definitely needed. I see the value in not having it reload without prompting, but to take away the prompts altogether is a bit extreme.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Depending on what you're actually doing, you might be able to make your changes through the Splunk UI, especially for search-time stuff. That doesn't require any reloading or waiting.

0 Karma

tkiss
Path Finder

So my assumptions were right, it indeed does not refresh it as it did in v5 🙂
I see your point and thanks for the insights although I'm very sad to hear the new direction. While I understand the goal and welcome it but as you said - for developers it's currently more difficult and time consuming.

Please if you could keep us posted on this thread if there's any current or future option to trigger a "poke-to-reload" functionality.

Happy Splunking!

Tamas

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...