In our existing Splunk environment we are mananging all the UF , indexer and Search head apps in one deployment server which caused issue in the knowledge objects that was created over the Search Head. Whenever there is a refresh . It rolls back to older changes
Now we want to manage the search head apps from Deployer instead of Deployment server.
In this process , how to to safely remove the server class that was created for SH apps in deployment server. On doing so will it delete the apps in Search head?
if you remove the client from the ServerClass Apps will be remeoved.
probably you could maintain apps pn SHs disabling the connection with Deployment Server, removing deploymentclients.conf from SHs, but I never tried this operation.
managing Search Heads and Indexers with Deployment Server isn't a good idea, as you experimented!
Anyway, you can manage Search Heads using Deployer only if you have a Search Head Cluster, are your SHs clustered?
In addition, to have a SH-Cluster you need at least three SHs, how many SHs do you have in your architecture?
Coming back to your question, you can remove SHs from the related ServerClass and all the apps will be removed by SHs, then you can configure SH-Cluster with Deployer and deploy the Apps or install your app manually.
Having a SH-Cluster has many additional advantages: