We have an environment where restart processes are controlled and monitored via a third party tool.
How do we push config bundles from a deployer to search head cluster members without a mandatory restart?
You should always allow Splunk to perform it's rolling restart process. But in the rare cases where it is necessary to control the restart process; you can run the following command (in it's entirety)
splunk apply shcluster-bundle -action stage && splunk apply shcluster-bundle -action send
This will bundle up the configs and push to the SHC peers; with no restart forced
Then you can later run
splunk rolling-restart shcluster-members
from the captain to perform the restart of all peers.
reference link:Control the restart process
View solution in original post