Hi, is there any way to reload configurations by splunk web rather that restart splunk after i have modified eventtype.conf and transform.conf, thanks.
Dianbo
The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Forums: SplunkGeneral: reload configuration
Previous Topic: Dashboard? View? Am I missing something? | Next Topic: Search Help
Posts 1–9 of 9
yes, run "anysearch terms | extract reload=true"
Since search is a separate process, configs must be re-read every time a search is run, so there should be no need to do anything at all to force Splunk to recognize changes.
I am sorry but it has no use for me. I modified the definition of one eventtype, but got result of old search string except i restart the splunk.(i run "anysearch terms | extract reload=true" at splunk web)
We know that when we execute "save to event type" to a search, the configuration file will be modified and the configuration will be reload, but the splunk will not be restarted (process id does not change). I want to know how it can do this. Thanks.
Bumping this. Is this possible yet with 4.1.2? I need to rsync my eventtypes.conf between two nodes but don't want to have to restart splunkd.
Reload of eventtypes (and all search time configurations in general) has never required a restart of splunkd in 4.x, so yes it is possible.
Ahh fantastic. Thanks, gkanapathy. I tested this by modifying (adding events to) the eventtypes.conf directly and then verifying they were listed in the webUI.
Well it seems to work halfway. I can add an event type to the file directly and have it show up. When I delete the same event type and go into 'manager -> event types' and search for the event it is still showing up. Any suggestions on how to remove it (besides clicking on 'delete')?