Splunk Infrastructure Overview — Question 24

When would a distributable streaming command be executed on an indexer?

Answer options

• A. If any of the preceding search commands are executed on the search head.
• B. If all preceding search commands are executed on the indexer, and a streamstats command is used.
• C. If all preceding search commands are executed on the indexer.
• D. If some of the preceding search commands are executed on the indexer, and a timechart command is used.

Correct answer: C

Explanation

The correct answer is C because a distributable streaming command runs only when all preceding commands are processed on the indexer, ensuring that the data is properly aggregated. Option A is incorrect as it refers to the search head, which does not trigger indexer execution. Option B is wrong because the presence of streamstats does not change the requirement that all commands must run on the indexer. Option D is also incorrect since it specifies 'some' commands, which does not meet the criteria for execution.