Splunk Enterprise Certified Architect — Question 45

When implementing KV Store Collections in a search head cluster, which of the following considerations is true?

Answer options

• A. The KV Store Collection will not allow for changes to content if there are more than 50 search heads in the cluster.
• B. The search head cluster captain is also the KV Store Primary when collection content changes.
• C. The KV Store Primary coordinates with the search head cluster captain when collection content changes.
• D. Each search head in the cluster independently updates its KV store collection when collection content changes.

Correct answer: C

Explanation

The correct answer is C because the KV Store Primary is responsible for coordinating with the search head cluster captain to manage content changes effectively. Option A is incorrect as there is no such limitation based on the number of search heads. Option B is wrong because the KV Store Primary is not necessarily the search head cluster captain, and option D is incorrect since updates are coordinated rather than performed independently by each search head.