Splunk Enterprise Security Certified Analyst — Question 45

In a single indexer cluster, where should the Monitoring Console (MC) be installed?

Answer options

• A. Deployer sharing with master cluster.
• B. License master that has 50 clients or more.
• C. Cluster master node
• D. Production Search Head

Correct answer: C

Explanation

The Monitoring Console (MC) should be installed on the Cluster master node as it is responsible for overseeing the entire cluster's health and performance. Options A and B are incorrect because they refer to other components that do not serve as the optimal location for the MC. Option D is also incorrect as the Production Search Head is not designed for monitoring cluster metrics.