Is there a difference placing a saved search on for example on ES or on a search head? What would be the consequences? What are saved searches "Best practices" ? Thank u in advance.
To be pedantic, ES *is* a search head so the question is *which* SH should run the search. If the search is related to ES (uses ES KOs, updates lookups, creates notable events, etc.) then it should run on the ES SH. All other searches should run on a different SH.