Can I move the /splunk/etc/apps/search/local folder to the deployers shcluster/apps/search/local folder? (And then push package?)
Reading the documentation it seems this would be a bad idea, but I want to move the savedsearches.conf, macros etc.
Or would it be a better idea to copy these folders to the search heads individually and restart Splunk?
This is from docs:
> **Caution:** Do not use the deployer to> push default apps, such as the search> app, to the cluster members. In> addition, make sure that no app in the> configuration bundle has the same name> as a default app. Otherwise, it will> overwrite that app on the cluster> members. For example, if you create an> app called "search" in the> configuration bundle, it will> overwrite the default search app when> you push it to the cluster members.
↧