Configurations from the deployer are merged into which location on the search head cluster member?

Configurations from the deployer are merged into which location on the search head cluster member?
A . SPLUNK_HOME/etc/system/local
B . SPLUNK_HOME/etc/apps/APP_HOME/local
C . SPLUNK_HOME/etc/apps/search/default
D . SPLUNK_HOME/etc/apps/APP_HOME/default

View Answer

Answer: B

Explanation:

Configurations from the deployer are merged into the SPLUNK_HOME/etc/apps/APP_HOME/local directory on the search head cluster member. The deployer distributes apps and other configurations to the search head cluster members in the form of a configuration bundle. The configuration bundle contains the contents of the SPLUNK_HOME/etc/shcluster/apps directory on the deployer. When a search head cluster member receives the configuration bundle, it merges the contents of the bundle into its own SPLUNK_HOME/etc/apps directory. The configurations in the local directory take precedence over the configurations in the default directory. The SPLUNK_HOME/etc/system/local directory is used for system-level configurations, not app-level configurations. The SPLUNK_HOME/etc/apps/search/default directory is used for the default configurations of the search app, not the configurations from the deployer.