How do I distribute the search app bundles on a search head cluster?

[xsstest]

In the search header cluster, we can use deployer to distribute app bundles

but I've always had a question.

If i need to update a configuration file on the search app. for example: I would like to add a lookup table in the search app /search/lookups/ or add a static file (.js) in the /search/appserver/static/ directory. So how should i do it?

A、copy $SPLUNK_HOME/etc/apps/search from search header to the $SPLUNK_HOME/etc/shcluter/apps/of the deployer
and then add the new lookup table or add a static file. Finally, through the splunk apply CLI to distribute the bundle

B、create a search directory directly under $SPLUNK_HOME/etc/shcluter/apps on the deployer, and then create the lookups directory in the search directory. Add a lookup table here, and finally through the splunk apply CLI to distribute the bundle

A and B, which method is correct?

Please forgive my English level, all the help would be appreciated.

[xsstest · Accepted solution]

create app on deployer,
then put your configuration file into the app folder and distribute it to the cluster members.
Finally, set the app for global sharing
Search app can share its configuration file in a shared way

[mwdbhyat]

The search head cluster will replicate certain runtime changes by default(if you edit the lookup in the gui or if done by CLI and REST). Otherwise if you edit a lookup or static config file, put it on the deployer and then push the changes to all SHC members as normal.

See here for reference: http://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/HowconfrepoworksinSHC

[xsstest]

I know that. I just want to ask: should I copy the search directory from the search app directory to depolyer, and then distribute the bundles?

[mwdbhyat]

If you are using the search app just copy whatever files you update into the search app folder on the deployer, alternatively you can create your own app and do that too.