Changing/adding the clustering "Secret Key" to an existing cluster.

[Ricapar]

I'm looking for information or suggestions about how to proceed with this.

When configuring a cluster in Splunk, it gives you the option of entering a "Secret Key" on each of the machines that'll be joined in as part of the cluster.

I have two scenarios I'd like some suggestions for, though I think the process might be the same for each:

1. The cluster was set up without a secret key, and we now want to put one in.
2. The cluster currently has a secret key set up, but it now needs to be changed to a new one.

What would the best way to approach this be, without disrupting the cluster and the indexing process much?

[stath002]

I would also be interested if there is a way to decrypt the current secret key. I am trying to add a new SH cluster that points to our singular indexer cluster but don't have the secret keys. Knowing it would be FAAR easier than changing it and it is needed to point the new SH cluster to the indexer cluster

[sloshburch]

Decrypting a password or Pass4SymmKey in a conf file is unlikely to ever be possible because it would unravel Splunk's security system. I believe the practice is change the Pass4SymmKey everywhere. It may be painful but it's less painful than the security implications of undoing the Pass4SymmKey.

[ppablo]

Hi @Ricapar

The following documentation has subsections following this page that explain how to configure the secret key for a cluster via dashboard, server.conf and CLI.
http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Clusterconfigurationoverview

This documentation covers making changes to a cluster configuration, including the secret key and the various ways of doing so as well.
http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Configurethepeers#Change_the_cluster_confi...

Hope this helps!

Patrick