Splunk Enterprise

Search Head Cluster: how to modify and replicate props.conf and transforms.conf?


The env is a search head cluster with 3 search heads.  Whenever I need to add a new transforms-extract, or a new props-extract, I need to modify the file /opt/splunk/etc/apps/search/local/props.conf, copy it over to all search heads, and then do a rolling restart.

The copy part isn't a problem (just run a script), but the rolling restart is disruptive to the production environment and every time it causes a long wait.

Is there a smoother way to  modify props.conf and transforms.conf and replicate their contents in a search head cluster environment?

Labels (1)
0 Karma


Hi @patng_nw 

Have you tried SHDeployer to push the configuration, Deployer make sure SH restarted in rollover fashion which you can control through cron job/ CD pipelines in your non business hours.

More red - Use the deployer to distribute apps and configuration updates - Splunk Documentation


An upvote would be appreciated if this reply helps and Accept the solution!

Tags (3)
0 Karma


Thanks.  I can do a searchable rolling restart through the UI as well, which is what I am doing.  I think my question is whether config changes such as new configured prop extraction can be added / modified without requiring any rolling restart.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!