For Splunk Enterprise Security (ES) applications and add-ons, it is necessary to copy the contents from the staging instance located at $SPLUNK_HOME/etc/apps to the deployer instance at the location $SPLUNK_HOME/etc/shcluster/apps. This specific directory on the deployer is designated for apps and configurations that need to be distributed to the search head cluster members.