Deployment Architecture

What actions require restarts?

pdevlin
Explorer

Does anyone have a complete list of configuration changes (via CLI or Manager) that require restarting Splunk?

I would like to limit or schedule these types of changes within my production environment so having a complete list would be very helpful.

Tags (1)

lguinn2
Legend

See Also
What Changes to configuation files require a restart of Splunk?

(sorry to have started a new thread)

0 Karma

Mick
Splunk Employee
Splunk Employee

Anything you edit directly in a config file you will have to restart for it to be picked up, apart from props.conf and transforms.conf, which can be reloaded using a search command - http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Extract

| extract reload=true

If you edit something you via the UI, it will automatically tell you if a restart is required, with a 'You need to restart your Splunk instance' message in the top left-hand corner

sideview
SplunkTrust
SplunkTrust

There's more to this answer though. The majority of conf file changes can actually be reloaded by hitting the /debug/refresh?entity=/admin/ endpoint. hit /debug/refresh to see all the reloadable entity names listed. Also see Sideview Utils which has a view called "The FreshMaker", which offers a nice UI to hit them all.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Only search-time relevant entries in props.conf and transforms.conf will be reloaded. Updates of index-time/parsing properties in the conf file will require a restart.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...