topic Re: Search Head Cluster: how to modify and replicate props.conf and transforms.conf? in Splunk Enterprise

Search Head Cluster: how to modify and replicate props.conf and transforms.conf?

patng_nw — Thu, 22 Jul 2021 02:15:09 GMT

The env is a search head cluster with 3 search heads. Whenever I need to add a new transforms-extract, or a new props-extract, I need to modify the file /opt/splunk/etc/apps/search/local/props.conf, copy it over to all search heads, and then do a rolling restart.

The copy part isn't a problem (just run a script), but the rolling restart is disruptive to the production environment and every time it causes a long wait.

Is there a smoother way to modify props.conf and transforms.conf and replicate their contents in a search head cluster environment?

Re: Search Head Cluster: how to modify and replicate props.conf and transforms.conf?

venkatasri — Thu, 22 Jul 2021 02:29:22 GMT

Hi @patng_nw

Have you tried SHDeployer to push the configuration, Deployer make sure SH restarted in rollover fashion which you can control through cron job/ CD pipelines in your non business hours.

More red - Use the deployer to distribute apps and configuration updates - Splunk Documentation

An upvote would be appreciated if this reply helps and Accept the solution!

Re: Search Head Cluster: how to modify and replicate props.conf and transforms.conf?

patng_nw — Thu, 22 Jul 2021 03:41:14 GMT

Thanks. I can do a searchable rolling restart through the UI as well, which is what I am doing. I think my question is whether config changes such as new configured prop extraction can be added / modified without requiring any rolling restart.