A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X,Y). During a search executed on search head X, indexer A crashes. What is Splunk’s response?
A.
Inform the user in Splunk web that their results may be incomplete and have them attempt the search from search head Y.
B.
Update the user in Splunk web informing them that the results of their search may be incomplete.
C.
Update the user in Splunk web that their results may be incomple and that Splunk will try to re-execute the search.
D.
Repeat the search request on indexer B without informing the user.
Splunk does not re-attempt searches on its own and changing the SH makes no sense if the Idx has not been recovered.
upvoted 3 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
SCARODJ
3 weeks, 1 day ago