Hi @bradaltf4, I'd like to add a consideration to the @richgalloway answer: why do you want to do this that surely doesn't run at the first restart (and restarting is mandatory in app installation)? It'r definitively easier to manage your Indexers using a Master Node (It was created with this role!). If yor need is to reduce bundle, probably the problem are the lookups, so you could blacklist some (or all) of them reducing the bundle dimension, solving the problem and maintaining the correct architecture. for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/Limittheknowledgebundlesize Ciao. Giuseppe
... View more