Splunk® Enterprise

Admin Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Splunk configuration methods

Splunk maintains its configuration information in a set of configuration files. You can configure Splunk by using any of these methods:

  • Editing configuration files directly.
  • Filling out fields in Splunk Manager in Splunk Web.
  • Specifying Splunk CLI commands.
  • App setup screens that use the Splunk REST API to update configurations.

All of these methods change the contents of the underlying configuration files.

To configure and manage distributed environments, you can use Splunk's deployment server.

Configuration files

Most of Splunk's configuration information is stored in .conf files. These files are located under your Splunk installation directory (usually referred to in the documentation as $SPLUNK_HOME) under /etc/system. You can make changes to these files using a standard text editor. Before you begin editing configuration files, read "About configuration files".

Splunk Manager

You can perform most common configuration tasks with Splunk Manager in Splunk Web. Splunk Web runs by default on port 8000 of the host on which it is installed:

  • If you're running Splunk on your local machine, the URL to access Splunk Web is http://localhost:8000.
  • If you're running Splunk on a remote machine, the URL to access Splunk Web is http://<hostname>:8000, where <hostname> is the name of the machine Splunk is running on.

To access Splunk Manager, log into Splunk Web and click Manager in the upper right hand corner.

Splunk CLI

Many configuration options are available via the CLI. These options are documented in their respective topics, or you can get a complete CLI help reference with the command help while Splunk is running:

./splunk help

For more information about the CLI, refer to "About the CLI" in this manual.

Setup screens for an app

Developers can create setup screens for an app that allow users to set configurations for their app without having to edit the configuration files directly. Setup screens make it easier to distribute apps to different environments, or to customize an app for a particular usage.

Setup screens use Splunk's REST API to manage the app's configuration files.

For more information about setup screens, refer to "Configure a setup screen for your app" in the Developing Views and Apps for Splunk Web manual.

Managing a distributed environment

The Splunk deployment server provides centralized management and configuration for distributed environments. You can use it to deploy sets of configuration files or other content to groups of Splunk instances across the enterprise.

For information about managing deployments, refer to "Deploy to other Splunk instances".

Restarting after configuration changes

Many changes to configuration files require you to restart Splunk. Check the configuration file or its reference topic to see whether a particular change requires a restart.

When you make changes in Manager, it will let you know if you have to restart.

These changes require additional or different actions before they will take effect:

  • Enable configuration changes made to props.conf or transforms.conf by typing the following search in Splunk Web:

| extract reload=T

  • To reload authentication.conf, use Splunk Web. Go to Manager > Access controls > Authentication method and click the Reload authentication configuration button. This refreshes the authentication caches, but does not disconnect current users.
PREVIOUS
Managing app configurations and properties
  NEXT
About Splunk Manager

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Comments

We have a "reload" command that does work for some configurations, you can check out the following topic to learn a little more about it:<br /><br />http://docs.splunk.com/Documentation/Splunk/latest/Admin/CLIadmincommands<br /><br />Thanks!

Jworthington splunk, Splunker
February 7, 2013

I wish there was a splunk command line able to reload the configuration, at least partly, without restarting splunk and disconnecting all users...

Yoho
February 7, 2013

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters