Splunk Enterprise Certified Architect — Question 60

An admin removed and re-added search head cluster (SHC) members as part of patching the operating system. When trying to re-add the first member, a script reverted the SHC member to a previous backup, and the member refuses to join the cluster.

What is the best approach to fix the member so that it can re-join?

Answer options

• A. Force the member add by running splunk edit shcluster-config --force.
• B. Review splunkd.log for configuration changes preventing the addition of the member.
• C. Clean the Raft metadata using splunk clean raft.
• D. Delete the [shclustering] stanza in server.conf and restart Splunk.

Correct answer: C

Explanation

The correct answer is C, as cleaning the Raft metadata is essential when a member has reverted and is unable to join the cluster. Options A and B do not address the root cause of the issue, while D would disrupt the configuration unnecessarily and is not a recommended solution.