Can I install the ES app in search head cluster via the deployer? I am assuming the app will be replicated on all search head members?
Is this configuration supported/allowed?
If you are using the Splunk App for Enterprise Security 3.2.1 or later, it does support search head clustering. Read the search head clustering topic in the Installation and Configuration Manual for details about the requirements and differences.
If you are using the Splunk App for Enterprise Security 3.2.1 or later, it does support search head clustering. Read the search head clustering topic in the Installation and Configuration Manual for details about the requirements and differences.
