Exam SPLK-2002 topic 1 question 39 discussion

A,B,D https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/SHCarchitecture#role_of_the_captain

can't believe no one noticed this lol..D is definitely wrong, because the term "search peers" is another name for indexers and a captain doesn't replicate to search peers, it replicates to search head cluster members

abcd chatgpt 4o piad model

Answer is A,B,D

ABD The KV store and search head clustering operate pretty much independently. The KV store captain is elected by its peers, just like the search head captain, although it is different code that runs those two elections. It's possible that one node would end up hosting both captains, but not necessary. The potential warning you point out is not a warning, but rather information about how kv store handles reads and writes. And where exactly do you think the docs are in conflict? KV store runs on a search head cluster, but search head clustering doesn't interact with the KV store.

Seems like C is wrong, per the comment that SpTester referenced, and the captain doesn't do anything with the peers, so AB.

Cannot select all options but all are valid here (ABCD).

Is ABCD

Option D is incorrect because the SHC captain is not responsible for replicating the SHC's knowledge bundle to the search peers. The SHC captain is responsible for managing the configuration and state of the SHC, including distributing the knowledge bundle to the other search heads in the cluster. However, it is the search peers that perform the actual searching against the indexed data, and they do not rely on the SHC captain to replicate the knowledge bundle.

Answer is A, B & C

ABCD ABD: https://docs.splunk.com/Documentation/Splunk/9.0.1/DistSearch/SHCarchitecture#Search_head_cluster_captain C: https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/ResyncKVstore#Resync_stale_KV_store_members

ABCD C: Slide219 (cluster) SHC captain and KV store primary synchronize their member lust everytime there is a status change The captain also coordinates activities among all cluster members D:slide186 cluster: Bundle replication to search peers happens only from the captain

Answers A, B and D https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCarchitecture#Role_of_the_captain In the last topic ("Search head clustering and KV store") we can read: KV store can reside on a search head cluster. However, the search head cluster does not coordinate replication of KV store data or otherwise involve itself in the operation of KV store. For information on KV store, see About KV store in the Admin Manual.

>ABCD is correct

ABCD: c: Slide219 (cluster) SHC captain and KV store primary synchronize their member lust everytime there is a status change The captain also coordinates activities among all cluster members. Its responsibilities include: Scheduling jobs. It assigns jobs to members, including itself, based on relative current loads. Coordinating alerts and alert suppressions across the cluster. The captain tracks each alert but the member running an initiating search fires it. Pushing the knowledge bundle to search peers. Coordinating artifact replication. The captain ensures that search artifacts get replicated as necessary to fulfill the replication factor. See Choose the replication factor for the search head cluster. Replicating configuration updates. The captain replicates any runtime changes to knowledge objects on one cluster member to all other members. This includes, for example, changes or additions to saved searches, lookup tables, and dashboards. See Configuration updates that the cluster replicates.