Out of interest, is the _cluster directory there for some special system reason ?
We distribute indexes.conf and parsing apps for the indexers by putting them in apps under master-apps and we've never done anything with the files under _cluster.
You recommend putting configs in _cluster (in here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distribute_the_configuration_bundle),
rather than appifying/containerizing all configs as per your normal best practice ?
It strikes me as something you (Splunk) are likely to update as you release new versions and add indexes (for example, _telemetry).
I'd call this a system directory, not a user manageable directory.
Soooo...I was just wondering why it's there.
... View more