Does anyone have a complete list of configuration changes (via CLI or Manager) that require restarting Splunk?
I would like to limit or schedule these types of changes within my production environment so having a complete list would be very helpful.
See Also
What Changes to configuation files require a restart of Splunk?
(sorry to have started a new thread)
Anything you edit directly in a config file you will have to restart for it to be picked up, apart from props.conf and transforms.conf, which can be reloaded using a search command - http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Extract
| extract reload=true
If you edit something you via the UI, it will automatically tell you if a restart is required, with a 'You need to restart your Splunk instance' message in the top left-hand corner
There's more to this answer though. The majority of conf file changes can actually be reloaded by hitting the /debug/refresh?entity=/admin/
Only search-time relevant entries in props.conf and transforms.conf will be reloaded. Updates of index-time/parsing properties in the conf file will require a restart.