Splunk Core Certified Advanced Power User — Question 35

Which Splunk component does a search head primarily communicate with?

Answer options

• A. Indexer
• B. Forwarder
• C. Cluster master
• D. Deployment server

Correct answer: A

Explanation

The correct answer is A, Indexer, as the search head retrieves and processes data stored in the indexers. The other options, such as Forwarder, Cluster master, and Deployment server, play different roles in the Splunk ecosystem and do not primarily interact with the search head for search queries.