Carefully design smaller apps with specific configuration that can be reused. This is the Splunk PS recommendation when using the deployment server and building deployment apps, because it allows for more flexibility, modularity, and efficiency in managing and deploying updates to Splunk Enterprise instances. Smaller apps with specific configuration can be easily reused across different server classes, environments, and use cases, without causing conflicts or redundancies. They can also reduce the size of the deployment bundle and the network bandwidth consumption.
The other options are incorrect because they are not the Splunk PS recommendation when using the deployment server and building deployment apps. Option B is incorrect because deploying only Splunk PS base configurations via the deployment server limits the functionality and customization of the deployment server, as it does not allow for deploying other types of apps, such as add-ons, dashboards, or custom configurations. Option C is incorrect because using $SPLUNK_HOME/etc/system/local configurations on forwarders and only deploying TAs via the deployment server is not a good practice, as it makes the forwarder configuration harder to manage and troubleshoot, and it does not leverage the full potential of the deployment server. Option D is incorrect because carefully designing bigger apps containing multiple configs is not a good practice, as it makes the deployment apps more complex, less reusable, and more prone to errors and conflicts. References:
Splunk Core Consultant knowledge source documents or study guide: https://www.splunk.com/en_us/resources/splunk-certification-exam-study-guide.html
Splunk Test Blueprint Consultant: https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-consultant.pdf
About deployment server and forwarder management1
Plan a deployment2
