How to change Splunk ES savedsearch.conf in search head cluster?

[hoangpt]

Hello, I have some issues regarding changing the configuration of Splunk Enterprise Security.
My system consists of 5 search heads and all apps and add-ons are pushed from the Deployer in the default push mode (merge_to_default), including Splunk ES.
The issue is that I previously configured the alert email in ES Content Update on the Search Head via the Web GUI, and this configuration would then be replicated to members in the cluster. Now I want to add another email to this section, but changing each rule manually is too time-consuming, so I directly edited the savedsearch.conf file, but it did not replicated to the remaining members.
After reading Splunk's documentation, I have an idea that I can change the push mode to local_only for the Splunk ES app, so that the savedsearch.conf file that was configured in:
$SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/local/savedsearchs.conf
Then push the bundle down to the captain, and the configuration will then be replicated to the remaining members in the cluster. Is this plan feasible and are there any potential risks that could occur when following this approach?

[meetmshah]

Were you able to resolve this @hoangpt?

[meetmshah]

Hello @hoangpt you can use deployer_push_mode from app.conf (https://docs.splunk.com/Documentation/Splunk/9.0.5/Admin/Appconf) if you temporary wants to use it for a specific app.

It will ensure that not all changes are following deployer_push_mode except a particular app

Please let me know if you have any questions or feel free to accept the answer if that helps

[hoangpt]

Help me 😞