I am not using deployment server in our environment yet. I have non-clustered search head and three indexers. If I want to create custom app where should I create it. on search head server or app server (indexer)?
I have same setup in A side (primary) and B side (standby). Both active - active.
A side - one search head and three app servers (indexers).
B side - one search head and three app servers (indexers).
I know this will consume double license but that's the requirement.
Recommendation is to restrict apps/dashboards to search heads.
And leave indexers to only receive data from forwarders and store indexes.
If you can read your index data from search heads, dashboards/apps can be created only at the search layer.
Users should be restricted to only search heads where your dashboards reside. This way, the indexed data would be safe/untouched at the indexer layer.
Thanks for the link which is very helpful. However, it does not provide answer I was looking for,
If I create new app or dashboard, whether I should create it on search head or indexer server itself?
If I create app or dashboard on search head, does it propagate that to the indexers automatic or I have to copy files manually from search head to indexer.
I am just thinking about syncing apps, dashboards, custom fields etc. etc. between search head and indexers.
I believe by default it does not get sync in between.
I created custom fields on search head for one type of data and created custom fields on indexer for second type of data.
When I looked into both search head and indexers, custom fields were missing on server other than where it was created.
So, I had to modify props.conf and transforms.conf manually so that it appears on other servers as well.
Is this the method I need to adopt or it can be achieved using some configuration level on search head and/or indexers?
What is this new app used for? Usually apps sit on Search head layer
Refer this link for examples/process - http://dev.splunk.com/view/quickstart/SP-CAAAFDC
Is your issue resolved? kindly accept and/or upvote my response if it helped