Search Head Clustering: How to push config bundles from a deployer to SHC members without a restart?

[phoffman_splunk]

We have an environment where restart processes are controlled and monitored via a third party tool.

How do we push config bundles from a deployer to search head cluster members without a mandatory restart?

[phoffman_splunk · Accepted solution]

You should always allow Splunk to perform it's rolling restart process. But in the rare cases where it is necessary to control the restart process; you can run the following command (in it's entirety)

splunk apply shcluster-bundle -action stage && splunk apply shcluster-bundle -action send

This will bundle up the configs and push to the SHC peers; with no restart forced

Then you can later run

splunk rolling-restart shcluster-members

from the captain to perform the restart of all peers.

reference link:Control the restart process