Hi,
We are using a commercial version of Maxmind databases and have been using them for city, ISP and Connection type lookups. We do weekly updates of the mmdb database files. We download the databases from the website and add it to our deployment server and run the reload deploy-server command to distribute the database to all the other nodes.
My query is: do we have to restart Splunk (set restartSplunkd=true) in serverclass.conf file for this or will the new database be used automatically?
PS: We do not use iplocation but have our own external lookup scripts to perform the Maxmind based lookups.
TIA,
Keerthana
↧