We have need to set ui preference with default time range picker globally across of the searches run in Splunk. We need to deploy these configuration across all three search Head Cluster Member in SHCM (search Head Cluster Memeber Pool)
Deployed application named "search_head_pushed_config" from deployer to Search head Cluster members.
The app has the following configuration was specified in ui-prefs.conf : [default]
dispatch.earliest_time = -15m
dispatch.latest_time = now
The config was pushed to the search cluster.
Note : Also for the App, “search_head_pushed_config” enabled settings for exporting globally by defining folloing, If not, its ui-prefs.conf will not be visible to other apps, which will prevent the timepicker customizations from applying in other app contexts.
So when you say to put these setting in $SPLUNK_HOME/etc/shcluster/apps/search_head_pushed_config/metadata Im guessing you mean the default.meta file?
What would happen over the course of time if I start adding new knowledge objects to the search_head_pushed_config app from the Splunk UI which creates a local.meta file, and then one day i push a update to this app from the deployer, will it delete my local.meta file since my deployer metadata folder only contains the default.meta? Im just now setting up my Search Head Cluster and still reading the docs but I haven't yet read anything that talks about how the metadata folder is handled if its managed by the deployer. The topics that are stressed that i read so far is what happens with the default and local directories.