Splunk Core Certified Advanced Power User — Question 15

Which of the following is a valid distributed search group?

Answer options

• A. [distributedSearch:Paris] default = false servers = server1, server2
• B. [searchGroup:Paris] default = false servers = server1:8089, server2:8089
• C. [searchGroup:Paris] default = false servers = server1:9997, server2:9997
• D. [distributedSearch:Paris] default = false servers = server1:8089; server2:8089

Correct answer: D

Explanation

Option D is correct because it uses the proper syntax for a distributed search group, including the correct separator for server addresses. Options A and B are incorrect as they either do not use the correct type or have the wrong syntax. Option C is also incorrect as it uses the wrong port for a distributed search group.