The search head captain will designate a search head to run the search and execute the script upon a triggering condition. So the script will run once on the search head member which was designated to run the search In a search head cluster, you use the deployer to deploy configurations to the search head members. They need to be in sync with each other, so its important that you don't add configs to the search head directly. Lastly, scripts have been deprecated from Splunk so you should really look into alert actions which can fire a script. https://docs.splunk.com/Documentation/Splunk/7.0.2/DistSearch/SHCdeploymentoverview https://docs.splunk.com/Documentation/Splunk/latest/Alert/Configuringscriptedalerts ... View more