Splunk Enterprise Certified Architect — Question 82

What is the best way to configure and manage receiving ports for clustered indexers?

Answer options

• A. Use Splunk Web to create the receiving port on each peer node.
• B. Run the splunk enable listen command on each peer node.
• C. Define the receiving port in /etc/manager-apps/_cluster/local/inputs.conf and push it to the peer nodes.
• D. Define the receiving port in /etc/deployment-apps/cluster-app/local/inputs.conf and deploy it to the peer nodes.

Correct answer: C

Explanation

The correct answer is C because defining the receiving port in /etc/manager-apps/_cluster/local/inputs.conf ensures that the configuration is applied across all peer nodes in a clustered environment. Options A and B do not provide a centralized configuration approach, while option D mistakenly suggests using the deployment apps, which is not appropriate for managing receiving ports in a cluster.