How can I reload a view I'm editing without restarting Splunk?

[jrodman]

I'm developing a view in Splunk, using an editor. How can I get my edits to load into the web user interface without restarting Splunk completely?

[louismai]

https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Configurationfilechangesthatrequirerestart
This works for me.

[koshyk]

https://<host>:<management_port>/servicesNS/nobody/<appName>/data/ui/views/_reload    

OR

https://<host>:<management_port>/servicesNS/nobody/system/apps/local/<appName>/_reload 

works perfectly as well.

[sideview]

In the more recent versions of Sideview Utils, there is a view called the 'FreshMaker', which offers

1) a pulldown to select which entity you'd like to reload, and a green submit button.

2) a lot of links down the left side, each representing one type of entity, like 'eventtypes', or 'views'.

Interacting with either will load the /debug/refresh page in an iframe on the right side. In practice this is faster and more usable than hitting the /debug/refresh URLs manually.

And if you notice in Splunk 6 that the /debug/refresh URL's take many seconds to load (as I did on some systems), the Sideview FreshMaker no longer uses those URL's but its own custom controller, so the FreshMaker will still load in a fraction of a second.

[David]

None of the above ever worked reliably for me, at least when I was editing default views via the filesystem. However, I was told about a trick that works splendidly: http://YourSplunkServer:8000/en-US/debug/refresh?entity=/admin/views

(Linked to from http://YourSplunkServer:8000/en-US/info )

[David]

Yeah, I can see that. This method gets you the latest version of the page, without needing to control+refresh or any of those shenanigans. It's also nice being able to have that in the browser, so you just refresh one tab, then go refresh another and you've got the newest version of the form (rather than needing to go to an SSH session). It also completes in about 1-2 seconds.

[jrodman]

restartss definitely works, because the appserver is entirely killed and starts up again. However, the browser cache may have to be defeated with shift-reload. I think your method tells splunkweb to update its cache-defeating url token.

[erydberg]

There are some refresh urls that are good to know about when building views, this is form the docs (http://www.splunk.com/base/Documentation/latest/Developer/AdvancedIntro):

useful URIs for view building

There are a few endpoints you should be aware of while you're working on building views, especially if you're working with the XML directly in the filesystem, and not through Splunk Manager.

Get a brand new view to show up:

https://localhost:8089/services/apps/local?refresh=true (replace with your host and Splunkd management port)

Reload a specific view:

https://localhost:8089/services/apps/local/?refresh=true (replace with your host and Splunkd management port)

Reload all views:

http://localhost:8000/app/< appname >/ (replace with your host and port)

[Mathieu_Dessus]

I've quickly done a script that will reload automatically the specified app when the XML files are modified:
http://mdessus.free.fr/Divers/reloadSplunkApp.pl
Feedback is welcome.

[vbumgarn]

That last one is da bomb, if you happen to be working on the default view of the app in question, since it redirects to the default view of the app. If you could put ?refresh=true on the end of any dashboard URL, that would be the easiest to remember.

This URL didn't work for me:
http://localhost:8000/app//
but these did:
http://localhost:8000/en-US/app/APPNAME//
http://localhost:8000/app/APPNAME//

[ftk · Accepted solution]

According to jrodman in #splunk on IRC (you might know him) one can reload all views in any given app by clicking the app's logo (the splunk> logo unless customized) in the top left of the page. Note that you will be returned to the default view of the app.

Another way is to restart splunkweb only using

./splunk restartss

to restart the splunkweb server.

Please note that restartss may not play well with active searches, so be cautious using it on production systems.

[jpenetra]

In order to enable the reload from clicking the logo the following property should be configured on the web.conf:

auto_refresh_views = 1

http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Webconf

[melting]

In Splunk 6 the best way is to use:
http://localhost:8000/en-US/debug/refresh

Or restart splunkweb

[phoenixdigital]

Does clicking the logo work any more with Splunk 6?

It doesnt appear to for me?

[sideview]

Cool. At some point it seemed to work only sporadically so I stopped using it. If it works reliably, then absolutely clicking the logo is the easiest way. Often this means that you need to leave another browser window open, just for clicking the logo though, and if you're going to do that you might as well have that page be the FreshMaker. 😉

[helge]

Clicking on the logo in the top left did it for me.

[sideview]

restartss will NOT reload the views. And the best way now is to use the "FreshMaker" view that comes with Sideview Utils. See my answer below.