Splunk props.conf – yeah, you have to restart splunk entirely when you make changes

On this page, it seems to indicate you could search with ” | extract reload=T” and it would reload your props.conf file. I didn’t see it work, at least not with extract-time transformations (it may work with search-time stuff).

http://ift.tt/1zpDC5H