Deployment Architecture

search head cluster apps

nawazns5038
Builder

Hi,

We use the deployer to distribute configs to the search head cluster. I want to add configs to the search heads which are independent to each other.

Can I place an app in the /etc/apps directory of each search head where as not causing any syncing issues with the deployer ?

Thanks

0 Karma

woodcock
Esteemed Legend

Given your response to my first answer, that certainly as a good reason to do such a thing. The answer is yes. If you put these differing configurations in the same app and that app is/was NOT deployed from the deployer, then it should be fine.

0 Karma

woodcock
Esteemed Legend

If that is your plan, DO NOT use a Search Head Cluster. It is like saying, I'd like to drive my airplane on the lake. You are defeating the entire purpose of a Search Head Cluster.

0 Karma

nawazns5038
Builder

hmm, the thing is I want to implement SAML on the search head cluster. I am unable to create the same entityId for all the search heads in our IDP, so each entityId has to be different so the configs would be different for all the search heads. I was thinking to put the related in an app and deploy individually on the search heads, version 6.5,3

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...