Chustar,
You're correct that you need to deploy them with the deployer. As you said, a "custom_configs" app is perfect for this.
I do see some folks splitting these custom configs up into a few apps, such as:
Indexes (for autocomplete). Often there is an indexes app that can be copied from the Indexer Cluster Master Node and re-used. Just remember to adjust the volume configurations or make them present.
Outputs app. Often there is an outputs app already configured correctly for Universal Forwarders in the environment on the Deployment Server.
A "SHC_settings" app for anything left over. limits.conf, server.conf, alert_actions.conf, etc. Whatever you need to do here that's SHC or SH specific.
There's no requirement to split them out into apps, but if you already have apps that do most of the things you'd like to push to the SHC then it makes sense to reuse them. If you prefer a combined app, that's fine too.
... View more