Splunk Enterprise Security Certified Analyst — Question 74

Which of the following server roles should be configured for a host which indexes its internal logs locally?

Answer options

• A. Cluster master
• B. Indexer
• C. Monitoring Console (MC)
• D. Search head

Correct answer: B

Explanation

The correct answer is B, Indexer, because this role is specifically designed to handle the indexing of log data. The other options, such as Cluster master, Monitoring Console (MC), and Search head, serve different purposes and are not responsible for the local indexing of logs.