When planning a search head cluster, which of the following is true?
A. All search heads must use the same operating system.
B. All search heads must be members of the cluster (no standalone search heads).
C. The search head captain must be assigned to the largest search head in the cluster.
D. All indexers must belong to the underlying indexer cluster (no standalone indexers).
|
Download Printable PDF. VALID exam to help you PASS. |
 |
C is incorrect
From document:
Splunk recommends that you use homogeneous machines with identical hardware specifications for all cluster members. The reason is that the cluster captain assigns scheduled jobs to members based on their current job loads. When it does this, it does not have insight into the actual processing power of each member’s machine. Instead, it assumes that each machine is provisioned equally.
Should be “A”
https://docs.splunk.com/Documentation/Splunk/8.0.4/DistSearch/SHCsystemrequirements
(there is no mention of “largest search head” in the docs)