High Availability And Distributed Search practice questions

They are automatically migrated by the cluster.

Why wrong: They must be moved manually to the app bundle.

They are deleted by the captain.

Why wrong: The captain doesn't delete files outside its control.

They are replicated to all members automatically.

Why wrong: The captain only replicates bundles it has pushed.

They cause a cluster startup error.

Why wrong: They are simply ignored.

Directing search requests to specific indexers.

Why wrong: This is done by the Search Head.

Indexing incoming forwarder data.

Why wrong: The CM does not ingest data.

Storing raw data and serving search requests.

Why wrong: This is the role of indexer peers.

Aggregating search results from indexers.

Why wrong: The Search Head performs aggregation.

5

Why wrong: This is not based on the provided factors.

4

Why wrong: This is not based on the provided factors.

1

Why wrong: This would not meet the search_factor requirement.

3

Why wrong: This is the replication factor, not the search factor.

peer_down_timeout

Why wrong: This is not a valid parameter.

max_search_time

Why wrong: This limits individual search job duration.

heartbeat_timeout

Why wrong: This controls communication between indexers and the master node.

search_retry_timeout

Why wrong: This is not a valid parameter.

Deployment Server

Why wrong: The DS manages configurations, not search routing.

License Master

Why wrong: The LM manages licensing tokens.

Indexer Peer

Why wrong: The indexer responds to the query but doesn't dictate affinity.

Cluster Master

Why wrong: The CM manages the indexers, not search affinity logic.

To act as the Cluster Master for indexers.

Why wrong: The indexer cluster has its own distinct master.

To store all bucket data for the indexers.

Why wrong: Search heads do not store indexed data.

To receive data from forwarders.

Why wrong: Indexers receive data from forwarders.

To distribute search results to the end user.

Why wrong: Any search head member can serve results to a user.

The search head cluster becomes read-only.

Why wrong: The cluster remains functional during re-election.

Indexers stop processing data.

Why wrong: Indexing is independent of SHC captain status.

The entire cluster must be restarted.

Why wrong: This would cause unnecessary downtime.

The search job is canceled immediately.

Why wrong: The cluster is designed for resilience; the search shouldn't be blindly canceled.

Delete all existing buckets.

Why wrong: This would result in permanent data loss.

Configure the site-specific replication factors.

Why wrong: This is done after enabling maintenance mode.

Upgrade the license server.

Why wrong: License server changes are not required for cluster migration.

Disable all forwarder data ingestion.

Why wrong: While recommended, it is not the mandatory first step for the CM configuration change.

Enable search_factor to 2 for all sites.

Why wrong: Search factor applies to the cluster globally, not per site.

Set replication_factor to 1 on each site.

Why wrong: This would result in no data redundancy.

Set cluster_mode to 'multisite_master'.

Why wrong: There is no 'multisite_master' mode; it is configured via the mode setting.

Configure the indexer as a site-local peer.

Why wrong: This does not define the cluster replication strategy.

It must be different for every member.

Why wrong: It should be the same port across all members.

It is only used by the captain.

Why wrong: All members use this port for replication.

It is used for forwarding data.

Why wrong: This port is strictly for SHC member communication.

It is automatically detected by the Cluster Master.

Why wrong: It must be explicitly configured.

The indexer is in maintenance mode.

Why wrong: Maintenance mode doesn't specifically prevent bucket searching if replicas exist.

The indexer disk is full.

Why wrong: A full disk would cause indexer failure, not just bucket status issues.

The license is expired.

Why wrong: An expired license results in a search block, not unsearchable buckets.

The Cluster Master is down.

Why wrong: If the CM is down, the cluster remains in its last known good state.

splunk cluster-check

Why wrong: This is not a valid command.

splunk inspect-cluster

Why wrong: This is not a valid command.

splunk search-peers

Why wrong: This is not a valid command.

splunk list indexers

Why wrong: This does not provide cluster-wide status.

inputs.conf

Why wrong: This is for data ingestion.

distsearch.conf

Why wrong: This is for distributed search settings.

props.conf

Why wrong: This is for parsing rules.

indexes.conf

Why wrong: This defines index properties but not cluster state.

The search fails immediately.

Why wrong: Splunk is designed for resilience; it will search other sites.

The search head waits for the local indexer to return.

Why wrong: This would cause unacceptable delays.

The search head only returns partial results.

Why wrong: It will attempt to complete the search if cross-site access is allowed.

The search head reports an error to the user.

Why wrong: It attempts to recover the query.

Using the Deployment Server.

Why wrong: The DS should not manage SHC configuration files.

Updating the captain only.

Why wrong: All nodes require the updated configuration.

Manual file copying to each node.

Why wrong: Manual changes break SHC consistency.

Using a shared network drive.

Why wrong: SHC nodes must have local config sets updated via the captain.

Ignore the peer and wait for timeout.

Why wrong: This leaves the cluster in a degraded state for longer than necessary.

Delete the indexer's data directory manually.

Why wrong: This will cause data loss and corrupt the cluster state.

Update the master node configuration.

Why wrong: The CM will detect the node is down automatically.

Shutdown the service without notice.

Why wrong: This forces the cluster to detect a failure and start unnecessary recovery cycles.

Cluster Master

Why wrong: CM is for indexers.

Index-time extraction

Why wrong: This is for parsing.

Bucket replication

Why wrong: This is for indexer storage redundancy.

Deployment Server

Why wrong: DS is for configuration files, not shared knowledge objects.

Disable the indexer peers.

Why wrong: Disabling peers removes them from the cluster.

Stop the Cluster Master first.

Why wrong: Stopping the CM stops all cluster management.

Restart all indexers at once.

Why wrong: This causes a complete outage.

Set 'replication_factor=1'.

Why wrong: This reduces redundancy and increases risk.

Set the indexer to maintenance mode.

Why wrong: This prevents it from joining the cluster.

Manually copy index buckets from other peers.

Why wrong: The CM handles replication automatically.

Restart all existing peers.

Why wrong: This is unnecessary and causes downtime.

Add the indexer to the indexer discovery list.

Why wrong: This is a forwarder-side setting.

Warm

Why wrong: Warm buckets have rolled from hot but are not yet cold.

Cold

Why wrong: Cold buckets are older data.

Frozen

Why wrong: Frozen buckets are archived/deleted.

Thawed

Why wrong: Thawed buckets are restored from frozen.