The splunk validate cluster-bundle --check-restart command is the officially documented Splunk Enterprise method to determine if a configuration bundle push will trigger a rolling restart within an indexer cluster.
When configuration changes are made on the Cluster Manager (Master Node)—for example, updates to indexes.conf, props.conf, or transforms.conf—Splunk administrators must validate the bundle before pushing it to all peer nodes. Using this command allows the Cluster Manager to simulate the deployment and verify whether the configuration modifications necessitate a restart across peer indexers to take effect.
The --check-restart flag specifically reports whether:
The configuration changes are minor (no restart required).
The changes affect components that require a full or rolling restart (e.g., changes to indexing paths, volume definitions, or replication factors).
Running this validation prior to an actual splunk apply cluster-bundle command prevents service disruption during production operations.
Other commands such as splunk show cluster-bundle-status display deployment status but not restart requirements, and splunk apply cluster-bundle executes the actual deployment, not validation.
References (Splunk Enterprise Documentation):
• Indexer Clustering: Deploy Configuration Bundles with Validation
• splunk validate cluster-bundle Command Reference
• Managing Indexer Clusters – Rolling Restarts and Bundle Deployment Best Practices
• Splunk Enterprise Admin Manual – Cluster Manager Maintenance Commands
