I have a splunk distributed system with 3 indexers, 3 search heads, a manger, and 2 heavy forwarders. I am attempting to deploy the DB Connect application to the HF and the SHC. The SHC has 3 member nodes and the deployer on the manger node. Ideally, this would all be done with ansible, sadly, the deployer gets in the way. I can deploy to the HF with ansible, but the deployer keeps removing the db connect app on the SHC.
That said, to deploy I install the app on the manager node, install the drivers, and then copy it to the ...shcluster/apps directory and run the splunk schcluster apply command. I've done this both manually and using ansible. When I run the apply the deployer does not put the entire app on the search heads, it only puts the default and metadata directories on the Search heads in the splunk_app_db_connect directory.
When I go into the manage apps on the GUI I see the app installed but it is not visible. I would prefer not to use the GUI for management and perform all management task via the cli and ansible. The code is stored in a version control system and gives not only control over the deployments but also trakcs who did what, when, why, and how.
So I guess there are multiple questions.
When using a Deployer, the default push mode is merge_to_default. So most likely is that it is merging local configs into default of the deployed app when it lands on the SH targets.
You can't mix different distribution methods. If you're using ansible, use it to deploy to the deployer - that's the way to manage the SHC. What the deployer pushes depends on the push mode.
Yes, I use ansible to push the app to the deployer. Then from within ansible I run the splunk apply shcluster.
Then check your push mode. If you want to push everything as is, you have to set it to "full" for this app.