The bundles sent from search head to indexer are not sent anywhere else.
Search heads do not communicate with forwarders.
Forwarders send data to indexers, but that is not a "bundle".
Deployment Servers (which can be part of an SH instance) communicate with forwarders to tell them which apps to download. These are not "bundles", either.
Not sure about the terminology but I see the following -
/monitor/splunkforwarder-linux/var/run/<app> $ \ls -tlr total 1252 -rw-------. 1 splunknu dce 1239040 May 16 11:15 Splunk_TA_nix-1558023151.bundle -rw-------. 1 splunknu dce 40960 Jun 14 09:38 <app>-1560523046.bundle
And by removing this
*.bundle file, the deployment server sends a new one.
Those are the apps downloaded by the forwarder from the DS. They're not usually referred to as bundles, but I see that is what the forwarder calls them. Thanks for the education!
The following mentions the
*.bundle files but not their
var/run/<app> location - Extended example: Deploy configurations to several forwarders
In the page, we can search for