All Apps and Add-ons

Can deployer be given the SH role?


I have a search head cluster and a deployer to push apps to the SH cluster. The deployer does not have a SH role and does not search _internal logs of the search head cluster. I installed the Search Activity app on the deployer in order to get insights on the searches done on the cluster. However, the app doesn't function correctly because of tha absence of interanal logs of the SH cluster. Is it advisable to give the SH role to the deployer to solve this?

0 Karma


Can you deployer search your indexers? I'm hoping all your SHC internal logs being forwarded to indexers.

0 Karma


Best practice would be do stand up another instance for DMC and have your search activity app installed there along with other monitoring. This way all your monitoring would be in one place.

Splunk Employee
Splunk Employee

I agree with this!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...