Splunk Enterprise Certified Architect — Question 35

Which of the following statements describe converting a non-clustered indexer to a cluster peer node? (Choose all that apply.)

Answer options

• A. Apps must be re-distributed via SPLUNK_HOME/etc/master-apps.
• B. Existing buckets are not replicated.
• C. Apps must be deleted from SPLUNK_HOME/etc/master-apps.
• D. Only new data coming into this peer is replicated.

Correct answer: A, B, D

Explanation

Option A is correct because applications must be redistributed to the correct directory for the peer node. Option B is also right since existing buckets do not get replicated when converting to a cluster peer. Option D is correct as well, indicating that only new incoming data will be replicated. Option C is incorrect because deleting apps is not a necessary step in this process.