Exam SPLK-1003 topic 1 question 39 discussion

Per the provided Splunk URL reference https://docs.splunk.com/Documentation/Splunk/7.3.1/InheritedDeployment/Deploymenttopology "Search heads manage searches. They handle search requests from user and distribute the requests across the set of indexers, which search their local data. The search head then consolidates the results from all of the indexers and serves them to the users."

Agreed. I only would default to indexer because that is where I see the most errors in the logs lol

Yes you are correct, but in this case not mention the distributed environment, i think that's why dirrect to indexers