Deployment Architecture
Highlighted

How do I disable the system configurations in the search head cluster?

Communicator

I enabled the system configurations in the search head cluster.

How do I disable them so they don't show up any more?

0 Karma
Highlighted

Re: How do I disable the system configurations in the search head cluster?

Communicator

Splunk Support gave me the correct answer. Rolling restart of the SHC resets the confgurations, so you no longer see the system level configs in the UI.

View solution in original post

Highlighted

Re: How do I disable the system configurations in the search head cluster?

Splunk Employee
Splunk Employee

Actually, it is not necessary to perform a rolling restart of the entire cluster. You merely need to restart the instance(s) on which you previously exposed the system settings (via the "Show All Settings button).

This is documented here: http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/HowconfigurationworksinSHC#The_Settings...

Highlighted

Re: How do I disable the system configurations in the search head cluster?

Communicator

How would I know which instance that was?

0 Karma
Highlighted

Re: How do I disable the system configurations in the search head cluster?

Splunk Employee
Splunk Employee

The system-level settings will only appear on those instances where you clicked "Show All Settings."

Highlighted

Re: How do I disable the system configurations in the search head cluster?

Communicator

I don't know which instance I am on, in a Search Head Cluster.

0 Karma
Highlighted

Re: How do I disable the system configurations in the search head cluster?

Splunk Employee
Splunk Employee

Presumably that's because you're accessing the cluster members from a load balancer. To determine the instance, the best approach would be to log into the members directly.

On the other hand, you can do as you did, which was to restart all instances. But it seems unnecessarily inconvenient to restart them all, when restarting just one would handle the need.

0 Karma