Splunk Core Certified Advanced Power User — Question 12

Which of the following apply to how distributed search works? (Choose all that apply.)

Answer options

• A. The search head dispatches searches to the peers.
• B. The search peers pull the data from the forwarders.
• C. Peers run searches in parallel and return their portion of results.
• D. The search head consolidates the individual results and prepares reports.

Correct answer: A

Explanation

Option A is correct because the search head is responsible for dispatching searches to peer nodes in a distributed search architecture. Options B, C, and D are incorrect because while peers do work in parallel, they do not pull data from forwarders directly; instead, they work on data that has been indexed. The search head consolidates results, but it does not prepare reports as part of the distributed search process.