Splunk Enterprise Security Certified Analyst — Question 6

What happens to the indexer cluster when the indexer Cluster Master (CM) runs out of disk space?

Answer options

• A. A warm standby CM needs to be brought online as soon as possible before an indexer has an outage.
• B. The indexer cluster will continue to operate as long as no indexers fail.
• C. If the indexer cluster has site failover configured in the CM, the second cluster master will take over.
• D. The indexer cluster will continue to operate as long as a replacement CM is deployed within 24 hours.

Correct answer: B

Explanation

The correct answer is B because the indexer cluster can still run without issues unless an indexer fails. Option A is incorrect since a warm standby CM is not necessary for continued operation. Option C is wrong as site failover does not automatically apply when the CM runs out of disk space, and option D is misleading because the cluster does not require a replacement CM to continue functioning immediately.