A financial services firm operates a multi-site indexer cluster with three sites: Site A (primary), Site B (secondary), and Site C (DR). They have configured RF=4, SRF=2, SF=2, and SSF=1. Site A has 4 peers, Site B has 3 peers, and Site C has 2 peers. A search head is located in Site B. A user runs a search that requires data from a bucket that has copies in all three sites. Which peers will the search head query?

Peers in all three sites to get the most complete results

Only peers in Site B that have searchable copies

Peers in Site A because it is the primary site

Peers in Site C because it has the fewest peers

What is the purpose of the site search factor in a multi-site indexer cluster?

To ensure that each peer node has a searchable copy of every bucket.

To ensure that the cluster master can search all buckets.

To ensure that all copies of each bucket are searchable.

To ensure that a specified number of searchable copies of each bucket exist in each site.

What is the primary role of the cluster master in a multi-site indexer cluster?

To store all indexed data and serve search requests.

To replicate data between sites in real time.

To manage replication and search across sites, including site awareness and failure handling.

To provide a user interface for searching across all sites.

What does the site replication factor specifically ensure in a multi-site indexer cluster?

That each peer node stores a copy of every bucket.

That the cluster master has a copy of all data.

That searchable copies of each bucket exist in each site.

That a specified number of copies of each bucket exist in each site.

In a Splunk multi-site indexer cluster, which statement correctly describes how replication and search behavior work?

The cluster master designates one site as the primary site, and all search requests are routed to that site regardless of where the search head is located.

Peer nodes replicate data to all other sites equally, and search heads randomly select peers from any site to balance the load.

Each peer node replicates data to a fixed set of peers in the same site, and searches are always broadcast to all sites to ensure complete results.

The cluster master assigns a primary site for each bucket, and search heads prefer to search peers in their own site, failing over to other sites when needed.

SplunkCore Certified Consultant

Domain 8Objective 4

Articulate How Multi-Site Clustering Works CORE-CERTIFIED-CONSULTANT Practice Questions (Page 1)

Part of the Indexer Clustering domain, which accounts for 18% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

7concepts

18%of the exam

Questions 1–5

1expert · medium
A financial services firm operates a multi-site indexer cluster with three sites: Site A (primary), Site B (secondary), and Site C (DR). They have configured RF=4, SRF=2, SF=2, and SSF=1. Site A has 4 peers, Site B has 3 peers, and Site C has 2 peers. A search head is located in Site B. A user runs a search that requires data from a bucket that has copies in all three sites. Which peers will the search head query?
Select an answer first
2foundation · easy
What is the purpose of the site search factor in a multi-site indexer cluster?
Select an answer first
3foundation · easy
What is the primary role of the cluster master in a multi-site indexer cluster?
Select an answer first
4foundation · easy
What does the site replication factor specifically ensure in a multi-site indexer cluster?
Select an answer first
5foundation · medium
In a Splunk multi-site indexer cluster, which statement correctly describes how replication and search behavior work?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.