Deployment Architecture

Splunk configuration changes - SIGHUP or restart?

araitz
Splunk Employee
Splunk Employee

Sometimes I make changes to my Splunk server's configuration, but I do not want to restart Splunk.

Which configuration changes require a restart, and which do not?

Also, does Splunk support a SIGHUP on linux/unix systems?

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

In general, settings which affect search take effect immediately, since searches are run in a separate process that reloads configurations. These settings include lookup tables, field extractions, tags and eventtypes.

Settings which affect indexing usually require a restart. These include index time field extractions, timestamp properties and index creation.

Input settings made through the UI and CLI do not require restarts and take place immediately.

Splunk doesn't yet support SIGHUP on unix systems, but that is certainly a commonly desired feature.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

In general, settings which affect search take effect immediately, since searches are run in a separate process that reloads configurations. These settings include lookup tables, field extractions, tags and eventtypes.

Settings which affect indexing usually require a restart. These include index time field extractions, timestamp properties and index creation.

Input settings made through the UI and CLI do not require restarts and take place immediately.

Splunk doesn't yet support SIGHUP on unix systems, but that is certainly a commonly desired feature.

jrodman
Splunk Employee
Splunk Employee

Heehee sending splunk a SIGHUP causes it to shut down. So you probably don't want to do this.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...