Clustered environment Search Head/Indexers

[YJ]

My current Splunk infra setup is clustered for Search Heads and Indexers. and  we are using deployer and cluster master to manage configs for the respective SH and IDX. For example, can I manually placed an updated config in SH1 and then run a rolling restart so they will sync/replicate with each other. ? This is in the event the Deployer is down. But eventually once the Deployer is up , we will place the updated config in Deployer. So that when we run a sync, it will not affect/remove the file from the SH cluster. Will there be any issues in this scenario?

[PickleRick · Accepted solution]

No. The SHC will not replicate files you manually place on one of the members of the cluster. That's what the deployer is for.

You could manually place some content on each of the SHs in cluster and that could work for some time (well, that's why you don't distribute/overwrite built-in apps from the deployer so you don't cause conflicts in case of upgrade).

Also when the deployer is up you have to manually push the configs, it will not happen automatically.