Monitoring Splunk

How to get Splunk aware of the changes in inputs.conf of an app without restarting Splunk?

Nicholas_Key
Splunk Employee
Splunk Employee

Hi all,

I've been searching high and low to understand how to get Splunk aware of the changes in inputs.conf of an app and then make use of the newly changed settings without restarting Splunk.

I want to have my configuration process similar to the UNIX and Wndows app (in which I check or uncheck the checkboxes and modify the poll intervals and I do not need to restart Splunk instance in order to have the changes in inputs.conf take effect)

This is the most related documentation I could find (but not useful enough):

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

You may find a very brief one-liner description "To add new inputs without restarting Splunk, use Splunk Web..."

I have restmap.conf in my app folder with the following stanza:

[admin_external:websphereapp]
handlertype = python
handlerfile = WebSphereApp_python_handler.py
handleractions = list, edit

And I have defined three method subclassed from MConfigHandler, namely

def setup(self)
def handleList(self, confInfo)
def handleEdit(self, confInfo)

I looked at admin.py and found (not sure if I'm looking at the correct things)

self.shouldReload = false
def handleReload(self, confInfo)

How should I define the handleReload method (so that I do not need to restart Splunk instance in order to have the changes in inputs.conf take effect)?

Thanks!

Nicholas

Tags (1)
1 Solution

amrit
Splunk Employee
Splunk Employee

You don't actually need to define the handleReload method yourself. In the part of your handler that makes changes to inputs.conf, you just need to call the reload method for the particular input type that you're modifying.

For example, if you added monitor:// stanzas to inputs.conf, simple make a GET request to /services/data/inputs/monitor/_reload. The _reload action is supported by all data inputs - if you look under /services/data/inputs, you can see which are available.

View solution in original post

Nicholas_Key
Splunk Employee
Splunk Employee

I'm thinking of using self.shouldReload=true in the handleEdit method and then call handleReload method at the end of the handleEdit definition

0 Karma

amrit
Splunk Employee
Splunk Employee

You don't actually need to define the handleReload method yourself. In the part of your handler that makes changes to inputs.conf, you just need to call the reload method for the particular input type that you're modifying.

For example, if you added monitor:// stanzas to inputs.conf, simple make a GET request to /services/data/inputs/monitor/_reload. The _reload action is supported by all data inputs - if you look under /services/data/inputs, you can see which are available.

Nicholas_Key
Splunk Employee
Splunk Employee

Thanks, I'll try this out 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...