Splunk Enterprise Security Certified Analyst — Question 71

When setting up a multisite search head and indexer cluster, which nodes are required to declare site membership?

Answer options

• A. Search head cluster members, deployer, indexers, cluster master
• B. Search head cluster members, deployment server, deployer, indexers, cluster master
• C. All splunk nodes, including forwarders, must declare site membership
• D. Search head cluster members, indexers, cluster master

Correct answer: D

Explanation

The correct answer is D because only the search head cluster members, indexers, and cluster master need to declare site membership in a multisite setup. Options A and B incorrectly include the deployer and deployment server, which do not require site membership. Option C is incorrect as it suggests that all Splunk nodes, including forwarders, must declare site membership, which is not necessary.