hi, when making changes to props files, which props files in splunk do not require restarting splunk and take effect on the fly? thanks,
Are you asking about props.conf in particular, or configuration files in general? Changes to props.conf almost always require a restart, see this previous Answers posting.
For a more general answer, see this Answers posting.
You should read the topics about configuration files in the Admin Manual, particularly the topic on configuration file precedence.
Are you asking about props.conf in particular, or configuration files in general? Changes to props.conf almost always require a restart, see this previous Answers posting.
For a more general answer, see this Answers posting.
You should read the topics about configuration files in the Admin Manual, particularly the topic on configuration file precedence.
No, you would never be. But, if you--hypothetically--were, I would admire you for it.
Not to be picky of course 🙂
Thanks for the refinement, Drainy. 🙂 I appreciate it the correction!
I'd disagree that they almost always require a restart, as Ayn posted below, anything search time related takes effect immediately as this part of the props is reloaded each time Splunkd forks off a new process to handle a search.
It's more about the settings that are changed, then the files themselves. Search-Time properties (EXTRACT, REPORT, FIELDALIAS, etc) are done "on the fly". Index-time properties (TRANSFORMS, LINE_BREAKER, parsing items, etc) need restarts. When in doubt, wait no more than 10 minutes, and then restart.
It's not a matter of which file the settings are in - Splunk reads settings from all props.conf files and merges them. Rather it's a matter of which specific settings. The general rule is that all settings affecting index-time behaviour (event breaking, timestamp parsing, etc) require a restart whereas all search-time settings (field extractions, lookups...) do not.
thanks xxx