Hi,
I am playing around with SA-Eventgen to generate data in a Dev environment but I find if I make a change to the eventgen.conf file I have to restart Splunk for it to take effect. (All I am doing is changing the date/time format)
Is there any other way to to make the change effective without having to carry out a restart? I have tried disabling and re-enabling via the Data input and also disabling and re-enabling the app itself but neither have the desired outcome.
Appreciate any help.
Cheers.
Paul.
Hi,
Thanks for replying.
I've tried using the URL suggested but it doesn't appear to have any effect.
There are no errors showing when I carry out a search using index="_internal" sourcetype="eventgen*"
Cheers.
Paul.
@newportknight
Is that any Errors in eventgen logs? Please execute below search for the eventgen log if you can found anything helpful.
index="_internal" sourcetype="eventgen*"
Hey Paul,
You can try doing this: http[s]://[splunkweb hostname]:[splunkweb port]/debug/refresh