Splunk Enterprise Certified Architect — Question 26

What command will decommission a search peer from an indexer cluster?

Answer options

• A. splunk remove cluster-peers --enforce-counts
• B. splunk offline --enforce-counts
• C. splunk disablepeer --enforce-counts
• D. splunk decommission --enforce-counts

Correct answer: B

Explanation

The correct command to take a search peer offline is 'splunk offline --enforce-counts', which effectively removes it from operation within the cluster. The other options either refer to different actions that do not specifically take a peer offline or are not valid commands for this purpose.