I created a indexes.conf file and placed it in my_all_indexes to keep them in one central location for easy management, which is in the apps folder on the indexer, forwarder, and deployment apps. Now all of my indexes are pointing to the same app. Is that normal, if not how do i change it back.? If i just delete it from these locations all the other apps goes away except the systems ones. How/where do I change them back. My environment 1 search head, 1 deployment server, 1 indexer, 1 Heavy forwarder, etc
usually indexes.conf is only on Indexers, so I hint to put it in a dedicated App (called e.g. TA_Indexers) and deplit it only on Indexers; if you have indexers.conf in all servers you create your indexes in all server and it isn't correct and unuseful.
For my approach, this is the way to manage all the apps: there is no reason to deploy Search Head Apps on Deployment Server or on Heavy Forwarder, because they cannot run (if you don't configure a distributed search) and you could think that there's a problem.
The best approach is to put the apps in the correct Splunk server:
TA_indexers on Indexer;
all your user Apps on Search Head;
all your TAs on deployment-apps folder of Deployment Server;