Deployment Architecture And Clustering practice questions

election_timeout

Why it fails: This affects the election duration, not the network tolerance.

replication_factor

Why it fails: This relates to data replication, not node connectivity.

search_timeout

Why it fails: This affects individual search execution, not cluster health.

splunk apply cluster-bundle --force

Why it fails: This forces an update but does not manage the rolling restart process.

splunk rolling-restart cluster-peers --check-status

Why it fails: This is not a valid flag for the rolling-restart command.

splunk restart indexer

Why it fails: This restarts a single node, not the cluster.

cluster_bandwidth_control

Why it fails: This is not a valid Splunk cluster parameter.

bandwidth_limit

Why it fails: This is not a valid Splunk cluster parameter.

max_replication_speed

Why it fails: This is not a valid Splunk cluster parameter.

replication_factor

Why it fails: This is for single-site clusters.

site_replication_policy

Why it fails: This is not a valid parameter in server.conf.

cluster_replication_mode

Why it fails: This parameter does not exist in Splunk clustering.

Deployment Server

Why it fails: The DS does not handle license verification.

Search Head

Why it fails: Search heads only need license access if they are performing indexing tasks or reporting.

Cluster Master

Why it fails: The CM does not act as a proxy for license checks.

To coordinate the election of the captain

Why it fails: The captain is elected by the search head members themselves.

To act as a load balancer for users

Why it fails: A separate load balancer is required for that.

To store the search results for the cluster

Why it fails: Search heads generate results, they are not stored on the deployer.

The load balancing algorithm

Why it fails: Load balancing is handled by the forwarder or indexer selection.

The user access rights

Why it fails: Access is managed through authentication.

The search head affinity

Why it fails: This is handled by search affinity settings.

Delete it after every deployment

Why it fails: This would prevent future updates.

Keep it in the /opt/splunk/etc/system/local directory

Why it fails: This is not where bundles are managed.

Automatically sync it to the Cluster Master

Why it fails: The CM does not manage SHC bundles.

Force a cluster bundle update

Why it fails: This is for configuration, not peer removal.

Delete the indexer directory on the CM

Why it fails: This does not trigger data migration.

Simply shut down the indexer service

Why it fails: This results in potential data loss if buckets aren't replicated.

The bucket is corrupt

Why it fails: Corruption has its own specific status.

The indexer is performing a hot-to-warm rollover

Why it fails: Rollover is a different state.

The data is being archived to cold storage

Why it fails: Archiving is a separate process.

max_peer_offline_time

Why it fails: This is not the exact parameter name.

bucket_expiry_time

Why it fails: This is for bucket lifecycle management.

cluster_peer_timeout

Why it fails: This is not a valid parameter.

A dedicated license master

Why it fails: A separate node is not required; it can be an existing node.

A dedicated load balancer for ingestion

Why it fails: Load balancers are recommended but not a hard requirement for the cluster itself.

A shared storage array for all peers

Why it fails: Indexers use local storage for performance.

The DS is a mandatory component for indexer clusters

Why it fails: It is recommended but not mandatory.

The DS should be used to update indexer cluster configurations

Why it fails: The CM must be used for indexer cluster bundles.

The DS manages the search head cluster captain election

Why it fails: The captain handles this.

The indexer must be running on the same OS version as the CM

Why it fails: OS versioning is not a hard requirement.

The indexer must be designated as a search head

Why it fails: Indexers and search heads are distinct roles.

Automatic load balancing across sites

Why it fails: Multisite clustering replicates data and provides site failover, but search-time load balancing across indexers is performed by the search head, not by the clustering layer itself. It is tempting because clustering does distribute replicated buckets, yet automatic query distribution is a search-head function.

Automatic user role migration between sites

Why it fails: Multisite clustering replicates buckets and search artefacts across sites; it does not migrate user roles, which are governed by authentication and role mapping, not cluster topology. It is tempting because site failover does shift search and replication duties, but role assignment remains with the search head or identity provider.

Edit the bucket.json file on the peer

Why it fails: This is not a supported method.

Delete the bucket directory from the peer

Why it fails: This causes data loss.

Use the 'mv' command on the filesystem

Why it fails: This corrupts the cluster's bucket map.

The cluster manager promotes the remaining searchable copies in site1 to primary buckets and stops replicating to site2 to avoid cross-site traffic.

Why it fails: There is no concept of promoting searchable copies to primary buckets in this manner. The cluster manager continues to maintain the configured replication and search factors, which may include cross-site replication to meet total counts. It does not stop replicating to site2 if that is needed to satisfy the total replication factor or to ensure data availability.

The cluster manager waits for the failed peer to come back online before taking any action, because multisite replication requires all original peers to be available.

Why it fails: The cluster manager does not wait indefinitely for a failed peer. It actively monitors peer health and, after a timeout, marks the peer as down and begins bucket fixup to restore replication and search factors. Multisite replication does not require all original peers to be available; it is designed to tolerate failures and maintain data availability across sites.

The buckets on the failed peer are marked as searchable only in site2, and the cluster manager reduces the replication_factor to 2 to compensate.

Why it fails: The cluster manager does not automatically reduce replication_factor; that would violate the configured data redundancy policy. It also does not arbitrarily mark buckets as searchable only in site2. Instead, it works to restore the configured replication and search factors by creating new copies as needed, respecting site constraints.

Set replication_factor to at least 2 and search_factor to at least 1.

Why it fails: These settings are too low to tolerate a site failure. To survive the loss of an entire site, the replication factor must be at least 2 times the number of sites (or more) so that each site has a complete copy of all buckets. With two sites, replication_factor should be at least 4 to ensure that each site can hold a full copy. A search factor of 1 would not provide searchable copies on both sites.

Set search_affinity to true on all search heads.

Why it fails: Search affinity is a feature that directs searches to indexers in the same site as the search head, but it is not a configuration setting on search heads. It is enabled by default in multisite clusters and is controlled by the search head's site designation. Setting search_affinity to true is not a valid parameter; affinity is automatically applied based on the search head's site.

Set multisite to true in the cluster master's server.conf.

Why it fails: The multisite setting is enabled by defining sites in the cluster master's server.conf, but simply setting multisite to true is not a valid configuration parameter. Multisite clustering is configured by specifying site parameters and site_replication_factor and site_search_factor. There is no multisite boolean setting; the presence of site definitions enables multisite mode.

License Master

Why it fails: The License Master only manages Splunk licence usage and violations across the deployment; it does not distribute configuration bundles to peers. It is tempting because it is a central management component, but bundle replication and cluster configuration are handled by the Cluster Manager, not licensing.

Deployment Server

Why it fails: The Deployment Server distributes configuration to forwarders via deployment apps, not configuration bundles to indexer cluster peers. It is tempting because it is the standard configuration-push mechanism, but indexer cluster bundle management belongs to the Cluster Manager.

Search Head

Why it fails: A Search Head queries indexed data and coordinates search activity; it does not push configuration bundles to cluster peers. It is tempting because search heads participate in the cluster, but bundle replication and peer configuration are the Cluster Manager's responsibility.

Move files to the var/run directory

Why it fails: var/run is runtime scratch space holding process state and ephemeral files, so configurations placed there are not loaded as user settings and vanish on restart. It is tempting as a writable location outside the replicated bundle path, but the correct approach uses a per-member local directory that bundle replication deliberately excludes.

Set the configuration to immutable in server.conf

Why it fails: Marking settings immutable in server.conf prevents the search head from accepting cluster bundle updates, breaking replication rather than preserving local overrides. It is tempting because immutability sounds like a way to shield local files. The correct mechanism is placing user configurations in a dedicated app under etc/apps or etc/shcluster/apps so bundles merge without overwriting.

Use the shcluster/ directory

Why it fails: The shcluster/ directory holds cluster-wide configuration replicated across members, so placing local user settings there exposes them to overwriting by the deployer's bundles. It is tempting because shcluster/ is the correct location for shared search head cluster artefacts, such as app bundles pushed to all members, not for member-specific local overrides.