Splunk Enterprise Certified Architect — Question 77

Which command is used to initially add a search head to a single-site indexer cluster?

Answer options

• A. splunk edit cluster-config -mode peer -manager_uri https://10.0.0.1:8089 -secret changeme
• B. splunk edit cluster-config -mode searchhead -manager_uri https://10.0.0.1:8089 -secret changeme
• C. splunk add cluster-master -manager_uri https://10.0.0.1:8089 -secret changeme
• D. splunk add cluster-manager -mode searchhead -manager_uri https://10.0.0.1:8089 -secret changeme

Correct answer: B

Explanation

The correct answer is B, as it specifies the mode as searchhead, which is necessary for adding a search head to the indexer cluster. Option A is incorrect because it sets the mode to peer, which is not applicable for a search head. Options C and D are also incorrect as they do not use the correct command format or mode for adding a search head.