Splunk Enterprise Certified Architect — Question 39

Which of the following server.conf stanzas indicates the Indexer Discovery feature has not been fully configured (restart pending) on the Master Node?

Answer options

• A. [clustering] mode = forwarder pass4SymmKey = $7$PU9SBXww63Vz3UJdDYGIN0UrdscRh83ssC2pEpwE6P3gn50iNFO94g==
• B. [clustering] mode = master pass4SymmKey = $7$tYTXzke+1r+3DULTHHDUTmYOXdtZJPxm21XwMARrJE20jsmicp9C3ni0
• C. [indexer_discovery] pass4SymmKey = idxdiscovery
• D. [indexer_discovery] pass4SymmKey = $7$XcXl1lu4950Jbui14oVe851+mvx6gCKKv6kf2zEaVB6Ie4DcZ657nLVlfW

Correct answer: C

Explanation

The correct answer, C, indicates that the Indexer Discovery feature is configured but not fully operational, as signified by the pass4SymmKey value set to 'idxdiscovery'. Options A and B refer to clustering configurations which do not pertain to Indexer Discovery, while option D shows a fully configured key for Indexer Discovery, suggesting it is active and not pending a restart.