Splunk Enterprise

Search Head Cluster: how to modify and replicate props.conf and transforms.conf?

patng_nw
Communicator

The env is a search head cluster with 3 search heads.  Whenever I need to add a new transforms-extract, or a new props-extract, I need to modify the file /opt/splunk/etc/apps/search/local/props.conf, copy it over to all search heads, and then do a rolling restart.

The copy part isn't a problem (just run a script), but the rolling restart is disruptive to the production environment and every time it causes a long wait.

Is there a smoother way to  modify props.conf and transforms.conf and replicate their contents in a search head cluster environment?

Labels (1)
0 Karma

venkatasri
Influencer

Hi @patng_nw 

Have you tried SHDeployer to push the configuration, Deployer make sure SH restarted in rollover fashion which you can control through cron job/ CD pipelines in your non business hours.

More red - Use the deployer to distribute apps and configuration updates - Splunk Documentation

--

An upvote would be appreciated if this reply helps and Accept the solution!

Tags (3)
0 Karma

patng_nw
Communicator

Thanks.  I can do a searchable rolling restart through the UI as well, which is what I am doing.  I think my question is whether config changes such as new configured prop extraction can be added / modified without requiring any rolling restart.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.