Hello, I have some issues regarding changing the configuration of Splunk Enterprise Security. My system consists of 5 search heads and all apps and add-ons are pushed from the Deployer in the default push mode (merge_to_default), including Splunk ES. The issue is that I previously configured the alert email in ES Content Update on the Search Head via the Web GUI, and this configuration would then be replicated to members in the cluster. Now I want to add another email to this section, but changing each rule manually is too time-consuming, so I directly edited the savedsearch.conf file, but it did not replicated to the remaining members. After reading Splunk's documentation, I have an idea that I can change the push mode to local_only for the Splunk ES app, so that the savedsearch.conf file that was configured in: $SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/local/savedsearchs.conf Then push the bundle down to the captain, and the configuration will then be replicated to the remaining members in the cluster. Is this plan feasible and are there any potential risks that could occur when following this approach?
... View more