Splunk Enterprise Security Certified Analyst — Question 52

In an environment that has Indexer Clustering, the Monitoring Console (MC) provides dashboards to monitor environment health. As the environment grows over time and new indexers are added, which steps would ensure the MC is aware of the additional indexers?

Answer options

• A. No changes are necessary, the Monitoring Console has self-configuration capabilities.
• B. Using the MC setup UI, review and apply the changes.
• C. Remove and re-add the cluster master from the indexer clustering UI page to add new peers, then apply the changes under the MC setup UI.
• D. Each new indexer needs to be added using the distributed search UI, then settings must be saved under the MC setup UI.

Correct answer: B

Explanation

The correct answer is B, as using the MC setup UI allows for reviewing and applying changes to ensure that new indexers are recognized. Option A is incorrect because while the MC has some self-configuration capabilities, manual adjustments are typically needed for new indexers. Option C is wrong because removing and re-adding the cluster master is unnecessary for adding new indexers. Option D is also incorrect since adding indexers through the distributed search UI does not update the MC settings directly.