All Apps and Add-ons

Add-on Debug Refresh: Is there a command to only refresh a certain endpoint?

shangshin
Builder

Hi,

The Add-on Debug Refresh is very useful, however, the refresh command takes a long time to finish. If I only need to refresh 1 endpoint only, is there a command to reload partially?

e.g. | refresh /servicesNS/admin/search/admin/alert_actions/_reload ?

Thanks in advance!

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi shangshin,

basically the command searches within all REST '/servicesNS/admin/search/admin' endpoints for a '_reload' link.
This is what the '/debug/refresh' command does.
If you want to reload only one specific endpoint simple use its URI.

Sorry but I don't have any Splunk server handy to test it.

The '| refresh' command will not support this function, because it was created on the need to reload everything with one single Splunk search command.

cheers,
MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi shangshin,

basically the command searches within all REST '/servicesNS/admin/search/admin' endpoints for a '_reload' link.
This is what the '/debug/refresh' command does.
If you want to reload only one specific endpoint simple use its URI.

Sorry but I don't have any Splunk server handy to test it.

The '| refresh' command will not support this function, because it was created on the need to reload everything with one single Splunk search command.

cheers,
MuS

MuS
SplunkTrust
SplunkTrust

Update:

there will be soon an update to the app released which works on Splunk 7.1.x. It also features the option to only reload one specific entity.

Link to the app: https://splunkbase.splunk.com/app/1871/#/details

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Update available here https://splunkbase.splunk.com/app/1871/

cheers, MuS

0 Karma

mkarikatti_splu
Splunk Employee
Splunk Employee

@Mus This app reloads everything in Splunk if the savedsearch is enabled (in version 1.0, it is enabled by default). It would be good to add a note on download page, to be cautious not to enable this app in production environments (specifically indexer cluster).

0 Karma

MuS
SplunkTrust
SplunkTrust

@mkarikatti Thanks for the feedback on the saved search, I will disable it by default.

But regarding the second comment: I will not add something like this into the notes.
The intention / reason for this app is to reload changed configs on the fly so you can test and validate them (actually I should add this line to the notes of the app 😉 ).
That said, I don't see a reason to put this app on any production instance.

0 Karma

MuS
SplunkTrust
SplunkTrust

@mkarikatti, btw in version 2 which is the most recent, the saved search is already disabled 😉

0 Karma

shangshin
Builder

Thanks for the reply.

I was using url to reload some config e.g. /debug/refresh?entity=admin/alert_actions

However, I wasn't able to find a way to do this programatically so I started to use this app.

Do you happen to know a way to invoke the URI programatically or using CLI command? Thank you!

0 Karma

MuS
SplunkTrust
SplunkTrust

Well, either take a look at the script inside the bin directory of the app or look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTTUT/RESTbasicexamples to get an idea 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...