Getting Data In

To modify access for a few users and also the index, can I make these changes from the Search Head, or do I need to do this from the indexer?

Abilan1
Path Finder

Hi ,

I wanted to modify access for a few users and also I want to modify the index. Can I make these changes from Search Head or I need to modify this from Indexer?

If I modify inputs.conf file, do I need to restart my index and search head?

Regards,
Abilan

0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

1.) Modifying access to indexes can be set on the search head. See steps 7 and 8 here.

2.) See this document for generalities about when to restart different parts of Splunk. It states:

When to restart Splunkd:
As a general rule, anything that modifies:

Settings and properties that affect indexers and indexing behavior
Settings and properties that affect users and roles.
Settings and properties that affect Splunk's core configuration.

There is a way to use reload too; but the docs state you should restart.
See these answers for more information.

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

1.) Modifying access to indexes can be set on the search head. See steps 7 and 8 here.

2.) See this document for generalities about when to restart different parts of Splunk. It states:

When to restart Splunkd:
As a general rule, anything that modifies:

Settings and properties that affect indexers and indexing behavior
Settings and properties that affect users and roles.
Settings and properties that affect Splunk's core configuration.

There is a way to use reload too; but the docs state you should restart.
See these answers for more information.

Abilan1
Path Finder

Hi Johnson,

Thank you so much for your help!

0 Karma

Abilan1
Path Finder

Hi,

I want to modify the index name. is it possible to do it from Search Head?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

I believe you can't rename it from the settings menu - you'll need to move it to the new name.

See this answer.
http://answers.splunk.com/answers/5479/how-to-rename-an-index.html

and this page:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Moveanindex

Abilan1
Path Finder

Hi Johnson,

if I want to modify the index itself, is it possible to do it from Search Head?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

What modifications do you want to make ?

There is lots of specific index management documentation here:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/HowSplunkstoresindexes#Buckets_and_Splunk_...

0 Karma

Abilan1
Path Finder

Thank you very much for your help!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...