splunk-search-head-cluster-setup

What problem does it solve?

This skill automates the end-to-end orchestration of a Splunk Search Head Cluster (SHC), including bootstrap, deployer bundle pushes, KV Store health checks, rolling restarts, captain transfers, and member lifecycle operations, reducing manual configuration drift and operator toil.

Core Features & Use Cases

• Render configuration: generate per-host server.conf for deployer and all SHC members, as well as KV Store settings and bootstrap scripts.
• Phase-driven deployment: validate, render, bootstrap, bundle-apply, and rolling-restart with safety gates and preflight checks.
• Lifecycle operations: add or decommission SHC members, migrate standalone SHCs to SHC, transfer captain, and replace the deployer with minimal disruption.

Quick Start

Render the SHC assets for your topology by running the render phase, then review and proceed with preflight, bootstrap, and bundle phases to apply changes safely.