Which of the following is a valid distributed search group?

The correct answer is D. [distributedSearch:Paris] default = false servers = server1:8089; server2:8089. In Splunk's distsearch.conf, distributed search peer groups use the [distributedSearch:<name>] stanza. Servers must be listed with the Splunk management port (8089) and separated by semicolons. Option A is missing port numbers and uses commas. Options B and C use the incorrect st

Distributed Search

Question

Options

A[distributedSearch:Paris] default = false servers = server1, server2
B[searchGroup:Paris] default = false servers = server1:8089, server2:8089
C[searchGroup:Paris] default = false servers = server1:9997, server2:9997
D[distributedSearch:Paris] default = false servers = server1:8089; server2:8089

How the community answered

(24 responses)

B
4% (1)
C
8% (2)
D
88% (21)

Explanation

In Splunk's distsearch.conf, distributed search peer groups use the [distributedSearch:<name>] stanza. Servers must be listed with the Splunk management port (8089) and separated by semicolons. Option A is missing port numbers and uses commas. Options B and C use the incorrect stanza name 'searchGroup'. Option C also incorrectly uses port 9997, which is the receiving port for forwarders, not the management port. Option D is the only entry with the correct stanza name, correct port (8089), and correct semicolon separator syntax.

Topics

#Distributed Search Configuration#Search Groups#distsearch.conf#Management Port

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice