When to restart Splunk Enterprise after a configuration file change

When you make changes to Splunk Enterprise using the configuration files, you might need to restart Splunk Enterprise for the changes to take effect.

Note: Changes made in Splunk Web are less likely to require restarts. This is because Splunk Web automatically updates the underlying configuration file(s) and notifies the running Splunk instance (splunkd) of the changes.

This topic provides guidelines to help you determine whether to restart after a change. Whether a change requires a restart depends on a number of factors, and this topic does not provide a definitive authority. Always check the configuration file or its reference topic to see whether a particular change requires a restart. For a full list of configuration files and an overview of the area each file covers, see List of configuration files in this manual.

When to restart forwarders

If you make a configuration file change to a heavy forwarder, you must restart the forwarder, but you do not need to restart the receiving indexer. If the changes are part of a deployed app already configured to restart after changes, then the forwarder restarts automatically.

When to restart splunkweb

You must restart splunkweb to enable or disable SSL for Splunk Web access.

When to restart splunkd

As a general rule, restart splunkd after making the following types of changes.

Indexer changes

• Index time field extractions
• Time stamp properties

For information on changes to indexes.conf settings that necessitate a restart, see Determine which indexes.conf changes require restart in Managing Indexers and Clusters of Indexers. In addition, for information on configuration bundle changes that initiate a restart, see Update common peer configurations and apps in Managing Indexers and Clusters of Indexers.

Note: When settings that affect indexing are changed through Splunk Web and the CLI, they do not require restarts and take place immediately.

User and role changes

Any user and role changes made in configuration files require a restart, including:

• LDAP configurations (If you make these changes in Splunk Web you can reload the changes without restarting.)
• Password changes
• Changes to role capabilities
• Splunk Enterprise native authentication changes, such as user-to-role mappings.

System changes

Changes that affect the system settings or server state require restart, such as:

• Licensing changes
• Web server configuration updates
• Changes to general indexer settings (minimum free disk space, default server name, etc.)
• Changes to General settings (e.g., port settings).
• Changing a forwarder's output settings
• Changing the time zone in the OS of a Splunk Enterprise instance (Splunk Enterprise retrieves its local time zone from the underlying OS at startup)
• Creating a search head cluster.
• Installing some apps may require a restart. Consult the documentation for each app you are installing.

Splunk Enterprise changes that do not require a restart

Search-time processing settings

Settings that apply to search-time processing take effect immediately and do not require a restart. This is because searches run in a separate process that reloads configurations. For example, lookup tables, tags, and event types are re-read for each search.

This includes (but is not limited to) changes to:

• Lookup tables
• Field extractions
• Knowledge objects
• Tags
• Event types

Files that contain search-time operations include (but are not limited to):

• macros.conf
• props.conf
• transforms.conf
• savedsearches.conf (If a change creates an endpoint you must restart.)

To reload your endpoints type the following into your browser:

http://<yoursplunkserver>:8000/en-US/debug/refresh

Index-time settings

Index-time props and transforms do not require restarts, as long as your indexers are receiving the data from forwarders. That is to say:

• Changes to props.conf and transforms.conf on an indexer do not require restarts.
• In an indexer cluster, changes to props.conf and transforms.conf are automatically reloaded when the peers receive the changes from the master.
• On a non-clustered indexer, changes to props.conf and transforms.conf require a reload.
• On either a clustered or non-clustered indexer, once the .conf files have reloaded, the changes take effect after a forwarder auto-LB time period.

How to reload files

To reload transforms.conf:

http://<yoursplunkserver>:8000/en-US/debug/refresh?entity=admin/transforms-lookup
for new lookup file definitions that reside within transforms.conf

http://<yoursplunkserver>:8000/en-US/debug/refresh?entity=admin/transforms-extract
for new field transforms/extractions that reside within transforms.conf

To reload authentication.conf, use Splunk Web. Go to Settings > Access controls > Authentication method and click Reload authentication configuration. This refreshes the authentication caches, but does not disconnect current users.

Restart an indexer cluster

To learn about restarts in an indexer cluster, and when and how to use a rolling restart, see Restart the entire indexer cluster or a single peer node in Managing Indexers and Clusters of Indexers.

Use cases

In complex situations, restarting Splunk Enterprise is the safest practice. Here are a few scenarios where you might (or might not) be able to avoid a restart.

Scenario: You edit search- or index-time transforms in props.conf and transforms.conf

Whether to restart depends on whether the change is related to a index-time setting or a search-time setting. Index-time settings include:

• line breaking
• timestamp parsing

Search-time settings relate mainly to field extraction and creation and do not require a restart. Any index-time changes still require a restart. For example:

1. If props.conf and transforms.conf are configured as search-time transforms on the index, you do not have to restart. For search-time changes, each time you run a search, Splunk software reloads the props.conf and transforms.conf.

2. If the search-time changes are on a heavy forwarder, you must restart that forwarder. (If the changes are part of a deployed app configured to restart after changes, then this happens automatically.)

3. If it is an index-time transform on the indexer, you must restart the indexer.

Scenario: You edit savedsearches.conf and the new search creates a REST endpoint

You must restart the indexer to integrate the new endpoint.