So there's a couple of answers to this and it depends on your environment. Are you doing search time extraction or index time extraction? If search time you'll want your TA's on the search head server class, if index time, the indexer class. The inputs apps will need to go in the class with your forwarders (be they heavy, lightweight, or universal) Since you are doing clustering, you could make a serverclass that contains only the cluster master to push apps to your indexers by way of pushing them to the cm and then logging into the cm and applying the cluster bundle. But you don't really want to be managing your cluster through a DS as a matter of best practice. I would however use the DS in your situation for the SH, unless you also have SHC enabled. In my environment, (very large, 500 indexers, 26 search heads) we use salt states to take care of all of this, but have individual states for varying aspects of the configuration. why im bringing this up is I would recommend structuring your serverclass similarly when writing it. For instance, if you are using custom SSL certs for splunkweb, andthat needs to go to your CM, DS, SH, and LM, then you make an ssl serverclass that manages just that aspect. Similar situation for pushing out your licensing app, etc. Hope I explained this clear enough, if I didnt feel free to ping me in the usergroups slack @f8al. If you're interested in possibly going the saltstack route, I can provide you with a sanitized dummy config to look at to get an idea of what exactly we are doing for that segmentation. ... View more