Hi,
I use to share my HEC tokens with the index cluster via deployment server. When I create the new token into Cluster Master, It doesn't require me a restart. But, when I share the inputs.conf via deployment-server and this conf goes to the indexer(or forwarder), It requires a restart in order to enable the new tokens.
Is there a way to push the tokens avoiding indexer(or forwarder) restart?
Hi ,
I would suggest you to create a serverclass and put the http_input app over there in the Deployment server,
Then reload the serverclass from the DS. You don't need to restart splunk over there anymore