I inherited a Splunk deployment and I trying to understand the config I see and what is referenced in the docs. The deployer app.conf lists "deployer_push_mode = default" and I am wondering if that means merge_to_default? Would it be best practice to change this to merge_to_default from default?
I looked at the app.conf.spec and answered my own question.
* Default (all apps except built-in apps): "merge_to_default"