Splunk Enterprise Certified Architect — Question 18

What are the possible values for the mode attribute in server.conf for a Splunk server in the [clustering] stanza? (Choose all that apply.)

Answer options

• A. [clustering] mode = deployer
• B. [clustering] mode = manager
• C. [clustering] mode = peer
• D. [clustering] mode = searchhead

Correct answer: B, C

Explanation

The correct options are B and C because in a Splunk environment, the clustering mode can be set to 'manager' for the cluster master and 'peer' for indexers. The other options, 'deployer' and 'searchhead', are not valid modes for the clustering stanza in server.conf.