Which components are required to define a multi-site indexer cluster in Splunk?

A cluster master, a deployment server, and a replication factor

A cluster master, peer nodes assigned to sites, and a site replication factor

Peer nodes, a license master, and a site search factor

A cluster master, a search head cluster, and a replication factor

A healthcare provider configures a multi-site indexer cluster with RF=3 and SRF=2. They want to ensure that a full site failure does not force searches to be served from a remote site with high latency. What additional setting should they configure to guarantee searchable copies exist in each site?

Set site search factor (SSF) to 2

What is rebalancing in a multi-site indexer cluster?

The process of moving search heads to different sites.

The process of redistributing bucket copies to meet replication factors after a peer node or site recovers.

The process of updating the cluster master's configuration.

The process of deleting old buckets to free up disk space.

A multi-site indexer cluster has three sites: Site A, Site B, and Site C. The cluster master is in Site A. Site B experiences a complete failure. The cluster master promotes copies in Site C to maintain RF and SRF. After Site B is restored, the cluster master initiates replication back to Site B. What is the primary reason the master does not immediately rebalance the cluster?

The master cannot rebalance until all peers are back online.

The master must first delete the Site B site configuration.

Rebalancing is not supported in multi-site clusters.

Rebalancing would cause unnecessary data movement and load on the network.

What happens when a peer node in a multi-site cluster fails?

The cluster master immediately shuts down the site.

The cluster master promotes another copy to ensure search availability and later rebalances.

The data on the failed node is permanently lost.

The cluster master requires manual intervention to restore service.

SplunkCore Certified Consultant

Domain 8Objective 4

Articulate How Multi-Site Clustering Works CORE-CERTIFIED-CONSULTANT Practice Questions (Page 4)

Part of the Indexer Clustering domain, which accounts for 18% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

7concepts

18%of the exam

Questions 16–20

16foundation · easy
Which components are required to define a multi-site indexer cluster in Splunk?
Select an answer first
17application · medium
A healthcare provider configures a multi-site indexer cluster with RF=3 and SRF=2. They want to ensure that a full site failure does not force searches to be served from a remote site with high latency. What additional setting should they configure to guarantee searchable copies exist in each site?
Select an answer first
18foundation · easy
What is rebalancing in a multi-site indexer cluster?
Select an answer first
19expert · hard
A multi-site indexer cluster has three sites: Site A, Site B, and Site C. The cluster master is in Site A. Site B experiences a complete failure. The cluster master promotes copies in Site C to maintain RF and SRF. After Site B is restored, the cluster master initiates replication back to Site B. What is the primary reason the master does not immediately rebalance the cluster?
Select an answer first
20foundation · easy
What happens when a peer node in a multi-site cluster fails?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.