Splunk Enterprise Security Certified Analyst — Question 46

When a bucket rolls from cold to frozen on a clustered indexer, which of the following scenarios occurs?

Answer options

• A. All replicated copies will be rolled to frozen; original copies will remain.
• B. Replicated copies of the bucket will remain on all other indexers and the Cluster Master (CM) assigns a new primary bucket.
• C. The bucket rolls to frozen on all clustered indexers simultaneously.
• D. Nothing. Replicated copies of the bucket will remain on all other indexers until a local retention rule causes it to roll.

Correct answer: B

Explanation

The correct answer is B because when a bucket rolls to frozen, the replicated copies stay on the other indexers while the Cluster Master assigns a new primary bucket. Option A is incorrect as original copies do not remain; Option C is wrong since the transition does not occur simultaneously across all indexers; and Option D is misleading as the process of rolling does happen, just not in the way described.