How would you configure your distsearch.conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON
In my opinion it is C:
Example from https://docs.splunk.com/Documentation/Splunk/8.1.0/DistSearch/Distributedsearchgroups:
[distributedSearch]
# This stanza lists the full set of search peers.
servers = 192.168.1.1:8089, 192.168.1.2:8089, 175.143.1.1:8089, 175.143.1.2:8089, 175.143.1.3:8089
[distributedSearch:NYC]
# This stanza lists the set of search peers in New York.
default = false
servers = 192.168.1.1:8089, 192.168.1.2:8089
[distributedSearch:SF]
# This stanza lists the set of search peers in San Francisco.
default = false
servers = 175.143.1.1:8089, 175.143.1.2:8089, 175.143.1.3:8089
And specifications from distsearch.conf:
servers = <comma-separated list>
* An initial list of servers.
* Each member of this list must be a valid URI in the format of
scheme://hostname:port
[distributedSearch]
servers = nyc1:8089, nyc2:8089, houston1:8089, houston2:8089
[distributedSearch:NYC]
default = false
servers = nyc1:8089, nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston1:8089, houston2:8089
B is wrong because the nyc1, nyc2, houston1, and houston2 doesn't have ports associated with them
C is the answer
see https://docs.splunk.com/Documentation/Splunk/8.0.3/DistSearch/Distributedsearchgroups
The servers attribute lists groups of search peers by IP address and management port.
The servers list for each search group must be a subset of the list in the general [distributedSearch] stanza.
A is also correct to me:
"the full set of search peers in the [distributedSearch] stanza will be queried when the search does not specify a search group."
https://docs.splunk.com/Documentation/Splunk/8.1.0/DistSearch/Distributedsearchgroups
Here the search specifies the search group
Plus they are supposed to be comma separated, not colons
upvoted 1 times
...
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
nottyan
Highly Voted 4 years, 3 months agonewrose
Highly Voted 4 years, 2 months agoNastyNutsu
Most Recent 1 month agoHR1234
7 months, 3 weeks agotmmt
2 years agotoney_mu
2 years agoSteve2610
2 years, 6 months agoMarco63
2 years, 10 months agorafiki31
2 years, 10 months agoApis
3 years, 1 month agoArDeKu
3 years, 11 months agoboruilei
4 years, 3 months agoAshton_98
4 years, 2 months agoAngusBlack
3 years, 7 months ago