Configurations from the deployer are merged into which location on the search head cluster member?

Question

Options

• ASPLUNK_HOME/etc/system/local
• BSPLUNK_HOME/etc/apps/APP_HOME/local
• CSPLUNK_HOME/etc/apps/search/default
• DSPLUNK_HOME/etc/apps/APP_HOME/default

• B
  95% (21)
• C
  5% (1)

Explanation

Configurations from the deployer are merged into the SPLUNK_HOME/etc/apps/APP_HOME/local directory on the search head cluster member. The deployer distributes apps and other configurations to the search head cluster members in the form of a configuration bundle. The configuration bundle contains the contents of the SPLUNK_HOME/etc/shcluster/apps directory on the deployer. When a search head cluster member receives the configuration bundle, it merges the contents of the bundle into its own SPLUNK_HOME/etc/apps directory. The configurations in the local directory take precedence over the configurations in the default directory. The SPLUNK_HOME/etc/system/local directory is used for system-level configurations, not app-level configurations. The SPLUNK_HOME/etc/apps/search/default directory is used for the default configurations of the search app, not the configurations from the deployer.

No community discussion yet for this question.