What is the default push mode for a search head cluster deployer app configuration bundle?

Question

Options

• Afull
• Bmerge_to_default
• Cdefault_only
• Dlocal_only

• A
  2% (1)
• B
  92% (60)
• C
  2% (1)
• D
  5% (3)

Explanation

Option B (merge_to_default) is correct because the Splunk Search Head Cluster deployer, by default, merges both the default/ and local/ directories from the app bundle and writes the result into the default/ folder on each cluster member - this is the merge_to_default behavior and ensures consistent, managed configurations across all members.

Why the distractors are wrong:

• A (full): A "full" push mode would overwrite all existing app content on members wholesale, which is too destructive for a default operation and is not the out-of-the-box behavior.
• C (default_only): This would push only the bundle's default/ folder, ignoring any local/ configurations in the bundle - Splunk doesn't default to discarding local/ content.
• D (local_only): Pushing only local/ content to members would bypass the intended configuration hierarchy and isn't a supported default push strategy.

Memory tip: Think "merge to default" as the deployer's job - it merges everything from your bundle and promotes it to default on cluster members, because local/ on a cluster member is reserved for user-level overrides, not deployer-managed config. The deployer always defaults to default.

No community discussion yet for this question.