A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X, Y). During a search executed on search head X, indexer A crashes. What is Splunk's response?

Question

Options

• AUpdate the user in Splunk web informing them that the results of their search may be incomplete.
• BRepeat the search request on indexer B without informing the user.
• CUpdate the user in Splunk web that their results may be incomple and that Splunk will try to re-
• DInform the user in Splunk web that their results may be incomplete and have them attempt the

• A
  93% (54)
• B
  2% (1)
• C
  3% (2)
• D
  2% (1)

Explanation

If an indexer goes down during a search, the search head notifies you that the results might be incomplete. The search head does not attempt to re-run the search on another indexer.

No community discussion yet for this question.