According to the Indexer Clustering Administration Guide, configuration bundles pushed from the Cluster Manager (Master Node) overwrite the contents of the $SPLUNK_HOME/etc/slave-apps/ directory on each search peer (indexer). However, Splunk provides a special persistent location — the _cluster app’s local directory — for files that must survive bundle redeployments.
Specifically, any configuration files placed in:
$SPLUNK_HOME/etc/slave-apps/_cluster/local/
will persist after future bundle pushes because this directory is excluded from the automatic overwrite process.
This is particularly useful for maintaining local overrides or custom configurations that should not be replaced by the Cluster Manager, such as environment-specific inputs, temporary test settings, or monitoring configurations unique to that peer.
Other directories under slave-apps are overwritten each time a configuration bundle is pushed, ensuring consistency across the cluster. Likewise, master-apps exists only on the Cluster Manager and is used for deployment, not persistence.
Thus, the _cluster/local folder is the only safe, Splunk-documented location for configurations that need to survive bundle redeployment.
References (Splunk Enterprise Documentation):
• Indexer Clustering: How Configuration Bundles Work
• Maintaining Local Configurations on Clustered Indexers
• slave-apps and _cluster App Structure and Behavior
• Splunk Enterprise Admin Manual – Cluster Configuration Management Best Practices
