Users log on to the search head and run reports:
The search head dispatches searches to the peers
Peers run searches in parallel and return their portion of results
The search head consolidates the individual results and prepares reports

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/SearchReference/Metadata

https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

The system default directory has the lowest priority in the global configuration context, meaning its settings are overridden by all higher-precedence layers such as app default, app local, and system local configurations.

To customize a configuration file, you need to create a new file with the same name in a local or app directory. Then, add the specific settings that you want to customize to the local configuration file. Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. The Splunk Enterprise upgrade process overwrites the default directory. To deploy configuration files to deployment clients, you need to use the deployment server. The deployment server is a Splunk Enterprise instance that distributes content and updates to deployment clients. The deployment server uses a directory called $SPLUNK_HOME/etc/deployment-apps to store the apps and configuration files that it deploys to clients. To update the configuration files in this directory, you need to edit them manually and then run the command $SPLUNK_HOME/bin/sp1unk reload deploy--server to make the changes take effect.