Hi @joe06031990  you can find out locations where SSL config present following command helpfull to get locations other tha default from command promt navigate to splunk--->bin run following command splunk btool inputs list ssl --debug | grep -i local use findstr instead of grep in case of windows  ... View more

Hi @rickymckenzie10  for your requirement, I would suggest to go for option 2 for upgarde let me explain difference as per my understanding  in most of the terms both works same but some differences. with Maintenance mode  you are telling cluster master that  some activity will happen on the indexers, it can be stopping splunk on indexer, rebooting the server , upgrading Splunk . With Maintenance mode enabled bucket replication will not happen in the entire cluster  once maintenance mode disabled, bucket fixup tasks will complete. With Rolling upgrade command , manager node understands that its upgrade of cluster and with running Rolling upgrade command also enables maintenance mode and tries to minimize the impact to searches.  ... View more

Hi @thevikramyadav  In addtion to @PickleRick answer , below is the basic understandinf of  SH cluster  Search head cluster need minimum of 3 search heads and max 100   Group of search heads where apps, search, artifacts and jobs scheduling are same   Group of search heads replicates knowledge objects replicates search artifacts increases search accessibility   Advantages Horizontal scaling High availability No single point of failure - Deployer Centralized location to distribute apps and other configurations to search head cluster members Not participate in searches - Captain - Its a cluster member with additional responsibilities - responsible include - Scheduling jobs/searches - Coordinating alerts and alerts suppression across the cluster - Pushes the knowledge bundle to search peers(indexers) - Coordinating artifacts replication - Replicating configuration updates - Cluster members - Same as search head in single instance - Participate in searches - Load balancer (optional) - 3rd party software - Resides between users and cluster members - Replication factor - Determines the number of copies of each artifact/search result - Only artifact/search result from scheduled saves searches are replicated - Results from ad hoc searches or real time searches are not replicated - by default, schedules saves searches results are stored in - $SPLUNK_HOME/var/run/splunk/dispatch/search/ - Search peers          - These Indexers where data is searched ... View more