QuestionQ116

Search Head Cluster Management and Administration

Which of the following is considered a good practice for a search head cluster deployer?

  • A The deployer only distributes configurations to search head cluster members when they "phone home".
  • B The deployer must be used to distribute non-replicable configurations to search head cluster members.
  • C The deployer must distribute configurations to search head cluster members to be valid configurations.
  • D The deployer only distributes configurations to search head cluster members with splunk apply shcluster-bundle.
Explanation

The deployer exists precisely to distribute non-replicated, non-runtime configuration updates (apps and configuration bundles) to search head cluster members, because those configurations are not shared through the cluster's own runtime replication mechanism. Therefore the good practice is that the deployer must be used to distribute non-replicable configurations to the members (B). Option D is wrong because the deployer does not distribute "only" via splunk apply shcluster-bundle — members also pull the current bundle when they join or restart — and this describes a mechanism rather than a good practice. Option A ("phone home") and C (configs invalid without the deployer) mischaracterize how the deployer works.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!