Splunk Enterprise Certified Architect — Question 50

Which command permanently decommissions a peer in an indexer cluster?

Answer options

• A. splunk offline --enforce-counts
• B. splunk stop
• C. splunk offline
• D. splunk edit cluster-config -mode disabled

Correct answer: A

Explanation

The correct command is 'splunk offline --enforce-counts', which ensures that the peer is fully removed from the cluster with proper count enforcement. The command 'splunk stop' merely halts the peer temporarily, while 'splunk offline' does not ensure a permanent decommissioning. 'splunk edit cluster-config -mode disabled' changes the mode but does not remove the peer from the cluster.