ExamTopics Logo
Mail Us[email protected]
Menu
Splunk Discussions
exam questions

Exam SPLK-3003 All Questions

View all questions & answers for the SPLK-3003 exam
Go to Exam

Exam SPLK-3003 topic 1 question 20 discussion

Actual exam question from Splunk's SPLK-3003
Question #: 20
Topic #: 1
[All SPLK-3003 Questions]

A customer has a search cluster (SHC) of six members split evenly between two data centers (DC). The customer is concerned with network connectivity between the two DCs due to frequent outages. Which of the following is true as it relates to SHC resiliency when a network outage occurs between the two DCs?

  • A. The SHC will function as expected as the SHC deployer will become the new captain until the network communication is restored.
  • B. The SHC will stop all scheduled search activity within the SHC.
  • C. The SHC will function as expected as the minimum required number of nodes for a SHC is 3.
  • D. The SHC will function as expected as the SHC captain will fall back to previous active captain in the remaining site.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by noysherer at July 12, 2021, 3:28 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
noysherer
Highly Voted 2 years, 11 months ago
It is B https://docs.splunk.com/Documentation/Splunk/8.2.1/DistSearch/DeploymultisiteSHC
upvoted 10 times
...
sunil299
Highly Voted 2 years, 10 months ago
B seems correct answers, as both site have equal SH and captain cannot be elected. During this time, the members on the other sites can continue to function as independent search heads. However, they will only be able to service ad hoc searches. Scheduled reports and alerts will not run, because, in a cluster, the scheduling function is relegated to the captain.
upvoted 5 times
...
bobixaka
Most Recent 1 month, 1 week ago
Selected Answer: B
To function properly the Captain needs the global majority across all sites to be alive. When one of the sites fail, we are left with 3 members only, which is not 51% majority and a Captain cannot be elected. Scheduled searches will be stopped. Ref: https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/DeploymultisiteSHC#What_happens_when_the_site_with_the_majority_fails
upvoted 1 times
...
spl_bonn
1 year, 8 months ago
Selected Answer: B
B is the correct one. SHC will lose the majority to elect a new captain.
upvoted 3 times
...
pepeperez
1 year, 11 months ago
Selected Answer: B
B is the one
upvoted 2 times
...
Redtonyeah
2 years, 1 month ago
I think B is correct
upvoted 3 times
...
prich1111
2 years, 10 months ago
Its C. Both sites will have 3 Shs. Each site will be able to elect a new captain independently and all functionality remains the same
upvoted 4 times
k3115807
2 years, 7 months ago
I found that. shc in 6 members need 4 members to election. https://docs.splunk.com/Documentation/Splunk/8.2.1/DistSearch/SHCarchitecture#Captain_election To become captain, a member needs to win a majority vote of all members. For example, in a seven-member cluster, election requires four votes. Similarly, a six-member cluster also requires four votes.
upvoted 1 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago