An indexer cluster master doesn't need apps, correct?

[msaz]

I'm new to cluster indexing, and am getting ready to start testing installing apps. Just want to confirm:

1. Apps are deployed to the indexers using cluster master configuration bundles.
2. Apps are deployed to the search head and forwarders using the deployment server.
3. Apps need to be installed on the indexers, search head, and forwarders.
4. Apps do NOT need to be installed on the cluster master.

[chrisyounger · Accepted solution]

Hi @msaz

1. Yes. You put apps in the etc/master-apps folder on the cluster master then push them to the indexers. They will end up in the etc/slave-apps folders on the indexers.
2. I find its best to only use the deployment server for pushing to Universal forwarders. You can use it to push apps to search heads, but if you have a search head cluster you should (must) use a "search head deployer". If you don't have a search head cluster then just install apps manually using the UI is easiest for most customers.
3. Yes. When you get an app from splunkbase read the documentation carefully becuase it will tell you where to put the app.
4. Yes. Its possible, but rare that you should need to put apps on the cluster master once it is configured.

All the best.