Question

Which of the following is NOT performed via Splunk Cloud Search Heads?

1) Install and manage apps
2) Define inputs and configure parsing
3) Create and manage indexes
4) Manage knowledge objects
5) Integrate with LDAP/SAML
6) Manage data retention

Answer 1

Splunk Cloud Search Heads do not perform the task of creating and managing indexes.

Step-by-step explanation:

The correct answer is option 3) Create and manage indexes.

Splunk Cloud Search Heads are used to distribute search workloads and provide a unified search experience across multiple Splunk instances. While Splunk Cloud Search Heads perform various administrative tasks, such as installing and managing apps, defining inputs and configuring parsing, and managing knowledge objects, they do not create and manage indexes.

Splunk indexes are managed on the search peers or indexers, which are separate from the search heads.