|
When you make changes to search-time extractions and other props.conf/transforms.conf settings, they can take effect right away without restarting any Splunk servers. (It's unclear to me if it happens automatically, and if so, how quickly, but it can always be forced with the However, this does not seem to occur with index-time properties, such as line-breaking/line-merging rules, timestamp rules, etc. Is there a way (perhaps via a REST endpoint call) to make a Splunk indexer refresh index-time properties and rules, either globally or per-app? |
|
search time extractions take effect immediately because each search reloads the configs there is currently no way to reload the index time properties without a restart Is there a way to trigger a restart alert message to the user? Perhaps similar behavior to enabling/disabling apps. Possibly something in the EAI I can post to? By the way, I'm trying to do this from setup.xml process, so it will be convenient to do so from there. Thanks, Danny
(05 Jan '11, 20:00)
dleung ♦
|
There's currently no app contextualiziation for index-time operations (through 4.1, probably also for 4.2). But that's aside from the fact that there's currently no reload ability.