A Splunk search head cluster has 5 members. The current captain suddenly loses network connectivity to the other 4 members but remains powered on. The remaining 4 members detect the captain's heartbeat timeout. What sequence of events occurs next in the cluster?

The cluster pauses all search activity until the original captain regains connectivity, because a majority of members cannot elect a new leader while the old one is still powered on.

All 4 remaining members increment their current term, become candidates, and each votes for itself. The candidate that receives votes from at least 3 members becomes the new captain.

The member with the lowest member ID automatically assumes the captain role without a vote, since the cluster must maintain quorum.

The 4 remaining members each wait for a random election timeout, then the first one to time out becomes captain without needing votes from the others.

A Splunk search head cluster has 3 members. The captain is healthy. An administrator wants to minimize the chance of unnecessary elections during brief network hiccups without significantly delaying failover when the captain truly fails. What configuration change is most appropriate?

Disable heartbeats and rely on manual failover to avoid false elections.

Decrease the election timeout on all members to detect failures faster.

Increase the heartbeat interval to send heartbeats more frequently.

Increase the election timeout on all members to a value larger than the typical network hiccup duration.

A Splunk search head cluster has 7 members. The captain fails. An election occurs, and candidate A receives votes from 3 members (including itself). Candidate B receives votes from 3 other members. One member has not voted. What happens?

No captain is elected because neither candidate has a majority of 4 votes. A new election round begins.

The member that has not voted is forced to vote for candidate A to break the tie.

Candidate B becomes captain because it has the same number of votes as A but a more up-to-date log.

Candidate A becomes captain because it has the same number of votes as B but a higher term.

In Splunk search head clustering, what is the primary purpose of the RAFT consensus algorithm?

To distribute search load evenly among all search heads in the cluster

To ensure all cluster members agree on a consistent cluster state and elect a single captain

To synchronize configuration files across all search heads in real time

To replicate search results across all cluster members for faster query performance

What is the primary purpose of heartbeats sent by the captain in a search head cluster?

To maintain leadership and prevent followers from starting new elections

To synchronize the configuration bundle across all members

To replicate search results to followers

To collect performance metrics from followers

SplunkCore Certified Consultant

Domain 9Objective 5

Articulate How Captain Election Works (RAFT) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 3)

Part of the Search Head Clustering domain, which accounts for 10% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

7concepts

10%of the exam

Questions 11–15

11application · medium
A Splunk search head cluster has 5 members. The current captain suddenly loses network connectivity to the other 4 members but remains powered on. The remaining 4 members detect the captain's heartbeat timeout. What sequence of events occurs next in the cluster?
Select an answer first
12expert · hard
A Splunk search head cluster has 3 members. The captain is healthy. An administrator wants to minimize the chance of unnecessary elections during brief network hiccups without significantly delaying failover when the captain truly fails. What configuration change is most appropriate?
Select an answer first
13expert · hard
A Splunk search head cluster has 7 members. The captain fails. An election occurs, and candidate A receives votes from 3 members (including itself). Candidate B receives votes from 3 other members. One member has not voted. What happens?
Select an answer first
14foundation · easy
In Splunk search head clustering, what is the primary purpose of the RAFT consensus algorithm?
Select an answer first
15foundation · easy
What is the primary purpose of heartbeats sent by the captain in a search head cluster?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.