Sync search head configs in 4.1

[Sqig]

Hi. We are not yet ready to upgrade to 4.2, where we can use the Search Head Pooling feature.

Until we can, we still want to be able to sync /opt/splunk/etc/apps/search/local/savedsearches.conf between our several search heads.

I have searched for this in documentation, but end up with 2 questions.

1. Can we use Deployment Server for this? The examples seem to be for Forwarders, but nothing stands out as a reason why we couldn't use it for syncing Search Heads as well.

2. If we cannot use Deployment Server for this, is there a method of reloading config files without bouncing Splunk itself? the "splunk reload" command seems only to be for authentication reloads and Deployment Server reloads.

Thanks.

[Ledion_Bitincka]

Also, you should be able to reload saved searches by hitting this (authenticated) URL

http://SearchHead:8089/services/properties/savedsearches?refresh=true

NOTE: there is more to search head pooling than just sharing configs - for example if you have scheduled searches in search head pooling only on search head will execute a scheduled search instance. If you simply sync savedsearches.conf, each search head will execute the scheduled searches and you could end up with duplicate alerts.

[JSapienza · Accepted solution]

Yes, you could use deployment server for this. Create an app with the conf files you want to deploy. Create a class in the serverclass.conf for the app, whitelist your servers and you are set.
I use deployment server to push conf's to all my Search Heads and Indexers. This way all I have to do when I stand up a new box is add the servername to the serverclass.conf under the appropriate classes and things are golden.