Splunk Enterprise Security Certified Analyst — Question 20

A customer has a new set of hardware to replace their aging indexers. What method would reduce the amount of bucket replication operations during the migration process?

Answer options

• A. Disable the indexing ports on the old indexers.
• B. Disable replication ports on the old indexers.
• C. Put the old indexers into manual detention.
• D. Put the old indexers into automatic detention.

Correct answer: C

Explanation

Putting the old indexers into manual detention prevents them from participating in any replication processes, thus minimizing unnecessary bucket replication during the migration. Disabling indexing or replication ports does not achieve the same effect, and automatic detention may still result in replication activities.