Deployment Architecture

How do I disable the system configurations in the search head cluster?

davebo1896
Communicator

I enabled the system configurations in the search head cluster.

How do I disable them so they don't show up any more?

0 Karma
1 Solution

davebo1896
Communicator

Splunk Support gave me the correct answer. Rolling restart of the SHC resets the confgurations, so you no longer see the system level configs in the UI.

View solution in original post

Steve_G_
Splunk Employee
Splunk Employee

Actually, it is not necessary to perform a rolling restart of the entire cluster. You merely need to restart the instance(s) on which you previously exposed the system settings (via the "Show All Settings button).

This is documented here: http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/HowconfigurationworksinSHC#The_Settings...

davebo1896
Communicator

How would I know which instance that was?

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

The system-level settings will only appear on those instances where you clicked "Show All Settings."

davebo1896
Communicator

I don't know which instance I am on, in a Search Head Cluster.

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

Presumably that's because you're accessing the cluster members from a load balancer. To determine the instance, the best approach would be to log into the members directly.

On the other hand, you can do as you did, which was to restart all instances. But it seems unnecessarily inconvenient to restart them all, when restarting just one would handle the need.

0 Karma

davebo1896
Communicator

Splunk Support gave me the correct answer. Rolling restart of the SHC resets the confgurations, so you no longer see the system level configs in the UI.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...