How do I disable the system configurations in the search head cluster?

[davebo1896]

I enabled the system configurations in the search head cluster.

How do I disable them so they don't show up any more?

[Steve_G_]

Actually, it is not necessary to perform a rolling restart of the entire cluster. You merely need to restart the instance(s) on which you previously exposed the system settings (via the "Show All Settings button).

This is documented here: http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/HowconfigurationworksinSHC#The_Settings...

[davebo1896]

How would I know which instance that was?

[Steve_G_]

The system-level settings will only appear on those instances where you clicked "Show All Settings."

[davebo1896]

I don't know which instance I am on, in a Search Head Cluster.

[Steve_G_]

Presumably that's because you're accessing the cluster members from a load balancer. To determine the instance, the best approach would be to log into the members directly.

On the other hand, you can do as you did, which was to restart all instances. But it seems unnecessarily inconvenient to restart them all, when restarting just one would handle the need.

[davebo1896 · Accepted solution]

Splunk Support gave me the correct answer. Rolling restart of the SHC resets the confgurations, so you no longer see the system level configs in the UI.