What is the Splunk PS recommendation when using the deployment server and building deployment apps?

Question

Options

• ACarefully design smaller apps with specific configuration that can be reused.
• BOnly deploy Splunk PS base configurations via the deployment server.
• CUse $SPLUNK_HOME/etc/system/local configurations on forwarders and only deploy TAs via the
• DCarefully design bigger apps containing multiple configs.

• A
  88% (22)
• C
  8% (2)
• D
  4% (1)

Explanation

Splunk Professional Services recommends designing smaller, modular apps with specific, focused configurations that can be mixed and matched across different forwarder groups - this promotes reusability, easier maintenance, and precise targeting of configurations to only the hosts that need them.

Why the distractors are wrong:

• B is too restrictive; the deployment server is used for all kinds of apps, not exclusively PS base configurations.
• C is incorrect because managing configurations directly in system/local on forwarders defeats the purpose of centralized deployment and is an anti-pattern.
• D is the opposite of best practice - large monolithic apps are harder to maintain, create conflicts, and can't be selectively applied to specific host subsets.

Memory tip: Think "Lego blocks" - small, purpose-built pieces that snap together cleanly are far more flexible than one giant, unwieldy brick. In Splunk, each deployment app should do one thing well (e.g., one app for inputs, one for outputs, one per TA) so you can deploy exactly what each forwarder needs.

No community discussion yet for this question.