What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

The deployer is a Splunk Enterprise instance responsible for managing and distributing configurations to the members of a search head cluster. Its primary function is to push a consistent set of knowledge objects, apps, and certain manual configurations from a central location ($SPLUNKHOME/etc/shcluster/) to all cluster members. This ensures uniformity for configurations that are not automatically replicated by the cluster captain, such as app configurations and other non-runtime settings.

B. Bootstraps a clean Splunk install for a SHC. Incorrect. Bootstrapping is an initial, one-time setup process performed on each member individually, not a function of the deployer.

D. Distributes runtime knowledge object changes made by users across the SHC. Incorrect. Runtime changes made via the UI (e.g., creating saved searches) are automatically replicated across members by the cluster captain.

Splunk Enterprise Distributed Search Manual, "Use the deployer to distribute apps and configuration updates". The documentation states, "The deployer is the tool for distributing apps and other configurations to the cluster members." It also clarifies, "You must use the deployer to distribute all app and configuration updates. Do not attempt to make ad hoc changes on individual members."

Splunk Enterprise Distributed Search Manual, "Configuration updates that the cluster replicates". This section distinguishes between deployer-pushed configurations and captain-replicated runtime configurations.