Splunk Enterprise Certified Architect — Question 68

Which command should be run to re-sync a stale KV Store member in a search head cluster?

Answer options

• A. splunk clean eventdata -local
• B. splunk clean kvstore - local
• C. splunk resync kvstore -local
• D. splunk resync kvstore -remote

Correct answer: B

Explanation

The correct answer is B because the command 'splunk clean kvstore -local' is specifically designed to clean and resynchronize the local KV Store member. Options A, C, and D are incorrect as they either pertain to different functionalities or target remote synchronization, which is not applicable in this context.