Splunk Enterprise Certified Architect — Question 89

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

Answer options

• A. adhoc_searchhead = true (on all members)
• B. adhoc_searchhead = true (on the current captain)
• C. captain_is_adhoc_searchhead = true (on all members)
• D. captain_is_adhoc_searchhead = true (on the current captain)

Correct answer: C

Explanation

The correct answer, C, ensures that the captain is not utilized for scheduled searches across all members, effectively distributing the workload. Options A and B do not prevent the captain from running scheduled searches as they only apply to adhoc search capabilities. Option D only affects the current captain and does not apply the setting to all members, which is less effective in load balancing.