SPLK-1003 · Question #202
How would you configure your distsearch.conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON
The correct answer is C. [distributedSearch]. The search specifies splunk_server_group=HOUSTON, meaning the search should be executed on the HOUSTON server group. In distsearch.conf, the configuration under must include the correct list of servers (houston1:8089, [distributedSearch:HOUSTON] houston2:8089). The section…
Question
How would you configure your distsearch.conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON
Options
- A[distributedSearch:NYC]
- B[distributedSearch]
- C[distributedSearch]
- D[distributedSearch]
How the community answered
(61 responses)- A8% (5)
- B3% (2)
- C84% (51)
- D5% (3)
Explanation
The search specifies splunk_server_group=HOUSTON, meaning the search should be executed on the HOUSTON server group. In distsearch.conf, the configuration under must include the correct list of servers (houston1:8089, [distributedSearch:HOUSTON] houston2:8089). The section includes all servers for distributed [distributedSearch] search (nyc1:8089, nyc2:8089, houston1:8089, houston2:8089). This allows Splunk to access both the NYC and Houston server groups for the search execution.
Topics
Community Discussion
No community discussion yet for this question.