Splunk Enterprise Security Certified Analyst — Question 31

A site from a multi-site indexer cluster needs to be decommissioned. Which of the following actions must be taken?

Answer options

• A. Nothing. Decommissioning a site is not possible.
• B. Create an alias for where the new data should be sent.
• C. Remove the site from the list of available sites.
• D. Remove the site from the list of available sites and create an alias for where the new data should be sent.

Correct answer: D

Explanation

The correct answer is D because when decommissioning a site, it is essential to both remove it from the list of available sites and create an alias for redirecting new data. Option A is incorrect as decommissioning is possible, while options B and C do not cover the complete necessary actions for proper decommissioning.