Deployment Architecture

Is there a base_config available for SHC?


Is there a base_config available for Search Head Clustering configuration?

If no, file approach of deploying SHC is not recommended?

Labels (1)


Since the default push mode is merge_to_default

all apps get deployed to /apps/default directory thus no base_config is used to configure SHC.


1. Slave-app local directories -- highest priority
2. System local directory
3. App local directories
4. Slave-app default directories
5. App default directories
6. System default directory -- lowest priority

0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...