The env is a search head cluster with 3 search heads. Whenever I need to add a new transforms-extract, or a new props-extract, I need to modify the file /opt/splunk/etc/apps/search/local/props.conf, copy it over to all search heads, and then do a rolling restart.
The copy part isn't a problem (just run a script), but the rolling restart is disruptive to the production environment and every time it causes a long wait.
Is there a smoother way to modify props.conf and transforms.conf and replicate their contents in a search head cluster environment?
Thanks. I can do a searchable rolling restart through the UI as well, which is what I am doing. I think my question is whether config changes such as new configured prop extraction can be added / modified without requiring any rolling restart.