Deployment Architecture

What actions require restarts?

pdevlin
Explorer

Does anyone have a complete list of configuration changes (via CLI or Manager) that require restarting Splunk?

I would like to limit or schedule these types of changes within my production environment so having a complete list would be very helpful.

Tags (1)

lguinn2
Legend

See Also
What Changes to configuation files require a restart of Splunk?

(sorry to have started a new thread)

0 Karma

Mick
Splunk Employee
Splunk Employee

Anything you edit directly in a config file you will have to restart for it to be picked up, apart from props.conf and transforms.conf, which can be reloaded using a search command - http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Extract

| extract reload=true

If you edit something you via the UI, it will automatically tell you if a restart is required, with a 'You need to restart your Splunk instance' message in the top left-hand corner

sideview
SplunkTrust
SplunkTrust

There's more to this answer though. The majority of conf file changes can actually be reloaded by hitting the /debug/refresh?entity=/admin/ endpoint. hit /debug/refresh to see all the reloadable entity names listed. Also see Sideview Utils which has a view called "The FreshMaker", which offers a nice UI to hit them all.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Only search-time relevant entries in props.conf and transforms.conf will be reloaded. Updates of index-time/parsing properties in the conf file will require a restart.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...