Search Head Cluster: how to modify and replicate props.conf and transforms.conf?

[patng_nw]

The env is a search head cluster with 3 search heads.  Whenever I need to add a new transforms-extract, or a new props-extract, I need to modify the file /opt/splunk/etc/apps/search/local/props.conf, copy it over to all search heads, and then do a rolling restart.

The copy part isn't a problem (just run a script), but the rolling restart is disruptive to the production environment and every time it causes a long wait.

Is there a smoother way to  modify props.conf and transforms.conf and replicate their contents in a search head cluster environment?

[venkatasri]

Hi @patng_nw 

Have you tried SHDeployer to push the configuration, Deployer make sure SH restarted in rollover fashion which you can control through cron job/ CD pipelines in your non business hours.

More red - Use the deployer to distribute apps and configuration updates - Splunk Documentation

--

An upvote would be appreciated if this reply helps and Accept the solution!

[patng_nw]

Thanks.  I can do a searchable rolling restart through the UI as well, which is what I am doing.  I think my question is whether config changes such as new configured prop extraction can be added / modified without requiring any rolling restart.