|
I'm developing a view in Splunk, using an editor. How can I get my edits to load into the web user interface without restarting Splunk completely? |
|
According to jrodman in #splunk on IRC (you might know him) one can reload all views in any given app by clicking the app's logo (the splunk> logo unless customized) in the top left of the page. Note that you will be returned to the default view of the app. Another way is to restart splunkweb only using to restart the splunkweb server. Please note that restartss may not play well with active searches, so be cautious using it on production systems. restartss will NOT reload the views. And the best way now is to use the "FreshMaker" view that comes with Sideview Utils. See my answer below.
(29 Apr '11, 11:27)
nick ♦
|
|
There are some refresh urls that are good to know about when building views, this is form the docs (http://www.splunk.com/base/Documentation/latest/Developer/AdvancedIntro): useful URIs for view building There are a few endpoints you should be aware of while you're working on building views, especially if you're working with the XML directly in the filesystem, and not through Splunk Manager. Get a brand new view to show up: https://localhost:8089/services/apps/local?refresh=true (replace with your host and Splunkd management port) Reload a specific view: https://localhost:8089/services/apps/local/?refresh=true (replace with your host and Splunkd management port) Reload all views: http://localhost:8000/app/< appname >/ (replace with your host and port) That last one is da bomb, if you happen to be working on the default view of the app in question, since it redirects to the default view of the app. If you could put ?refresh=true on the end of any dashboard URL, that would be the easiest to remember. This URL didn't work for me: http://localhost:8000/app// but these did: http://localhost:8000/en-US/app/APPNAME// http://localhost:8000/app/APPNAME//
(02 Oct '10, 00:58)
vbumgarn
I've quickly done a script that will reload automatically the specified app when the XML files are modified: http://mdessus.free.fr/Divers/reloadSplunkApp.pl Feedback is welcome.
(29 Oct '11, 13:16)
Mathieu Dessus
|
|
None of the above ever worked reliably for me, at least when I was editing default views via the filesystem. However, I was told about a trick that works splendidly: http://YourSplunkServer:8000/en-US/debug/refresh?entity=/admin/views (Linked to from http://YourSplunkServer:8000/en-US/info ) restartss definitely works, because the appserver is entirely killed and starts up again. However, the browser cache may have to be defeated with shift-reload. I think your method tells splunkweb to update its cache-defeating url token.
(26 Jan '11, 19:13)
jrodman ♦
Yeah, I can see that. This method gets you the latest version of the page, without needing to control+refresh or any of those shenanigans. It's also nice being able to have that in the browser, so you just refresh one tab, then go refresh another and you've got the newest version of the form (rather than needing to go to an SSH session). It also completes in about 1-2 seconds.
(29 Apr '11, 11:22)
David
|
|
In the more recent versions of Sideview Utils, there is a view called the 'FreshMaker', which offers 1) a pulldown to select which entity you'd like to reload, and a green submit button. 2) a lot of links down the left side, each representing one type of entity, like 'eventtypes', or 'views'. Interacting with either will load the /debug/refresh page in an iframe on the right side. In practice this is faster and more usable than hitting the /debug/refresh URLs manually. |
