What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

Question

Options

• ADistributes apps to SHC members.
• BBootstraps a clean Splunk install for a SHC.
• CDistributes non-search-related and manual configuration file changes.
• DDistributes runtime knowledge object changes made by users across the SHC.

Explanation

Deployer in a Search Head Cluster (SHC)

Correct Answers: A and C

The deployer is a standalone Splunk instance (not a cluster member) that administrators use to push apps and manual configuration file changes to all SHC members via splunk apply shcluster-bundle. This covers both app distribution (A) and non-search-related or manually edited config files (C), such as inputs.conf or outputs.conf changes made outside the UI.

Why B is wrong: Bootstrapping initializes the SHC and elects the first captain - this is done via CLI commands directly on the search head members (splunk bootstrap shcluster-captain), not by the deployer.

Why D is wrong: Runtime knowledge object changes - things users create interactively like saved searches, dashboards, and alerts - are replicated automatically among cluster members by the captain, not pushed by the deployer.

Memory tip: Think of the deployer as the "admin push" tool - it handles deliberate, admin-initiated changes (apps + config files). Anything a user creates at runtime gets handled internally by the cluster captain via replication. Deployer = admin-side; Captain replication = user-side.

No community discussion yet for this question.