Where should I create custom app. on search head or app server (indexer) ?

[patelmc]

I am not using deployment server in our environment yet. I have non-clustered search head and three indexers. If I want to create custom app where should I create it. on search head server or app server (indexer)?

I have same setup in A side (primary) and B side (standby). Both active - active.
A side - one search head and three app servers (indexers).
B side - one search head and three app servers (indexers).

I know this will consume double license but that's the requirement.

[nareshinsvu]

Recommendation is to restrict apps/dashboards to search heads.
And leave indexers to only receive data from forwarders and store indexes.

If you can read your index data from search heads, dashboards/apps can be created only at the search layer.

Users should be restricted to only search heads where your dashboards reside. This way, the indexed data would be safe/untouched at the indexer layer.

[patelmc]

Thanks for the link which is very helpful. However, it does not provide answer I was looking for,
If I create new app or dashboard, whether I should create it on search head or indexer server itself?
If I create app or dashboard on search head, does it propagate that to the indexers automatic or I have to copy files manually from search head to indexer.
I am just thinking about syncing apps, dashboards, custom fields etc. etc. between search head and indexers.
I believe by default it does not get sync in between.
I created custom fields on search head for one type of data and created custom fields on indexer for second type of data.
When I looked into both search head and indexers, custom fields were missing on server other than where it was created.
So, I had to modify props.conf and transforms.conf manually so that it appears on other servers as well.

Is this the method I need to adopt or it can be achieved using some configuration level on search head and/or indexers?

[nareshinsvu]

What is this new app used for? Usually apps sit on Search head layer

Refer this link for examples/process - http://dev.splunk.com/view/quickstart/SP-CAAAFDC

[nareshinsvu]

Is your issue resolved? kindly accept and/or upvote my response if it helped