Question

Which stanzas and attributes are used to configure a Search Head to belong to multiple clusters?

A) server.conf [clustering] mode = searchhead master_uri = clustermaster:, clustemaster:...
B) distsearch.conf [multicluster] mode = searchhead master_uri = clustermaster:, clustemaster:...
C) server.conf [clustering] mode = indexer master_uri = clustermaster:, clustemaster:...
D) cluster.conf [searchhead] mode = cluster master_uri = clustermaster:, clustemaster:...

Answer 1

To configure a Search Head for multiple clusters in Splunk, the correct option is B) distsearch.conf [multicluster] mode = searchhead master_uri = clustermaster1_uri, clustermaster2_uri... The correct stanza and file to use is [multicluster] in distsearch.conf.

Step-by-step explanation:

To configure a Search Head to belong to multiple clusters in Splunk, you need to specify the correct settings in the configuration files. The correct answer is:

B) distsearch.conf [multicluster] mode = searchhead master_uri = clustermaster1_uri, clustermaster2_uri...

This configuration is entered in the distsearch.conf file. The [multicluster] stanza is used to specify that a search head is part of multiple clusters. In this stanza, you set the mode to searchhead and provide a comma-separated list of the master_uris for each cluster master the search head should connect to.