How can we convert multisite search head clustering into single site search head clustering?

[maniu1609]

Hi Team,
I could find Splunk doc for converting multisite indexer clustering into single site indexer clustering.
But I'm unable to find document for converting multisite search head clustering into single-site search head clustering.
Is this possible to convert?

Could you please help me here.

Thanks in advance

[adonio · Accepted solution]

yes it is possible
sites in splunk are logical terms.
you can simply change the site = <site(n) in server.conf
if you have search affinity configured, your search heads will look at the site they are affiliated with

hope it helps

[maniu1609]

Do we need to remove site= site1 and multisite=true settings in server.conf file in all search heads?

[adonio]

yes, that will do the trick
read here as you can also keep multisite=true and have splunk ignore the site affiliation by changing the site value to site0
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Multisitesearchaffinity#How_to_disable_se...