How would you configure your distsearch.conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

The correct answer is D. [distributedSearch]. To run the search sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON, the configuration in the distsearch.conf file must define the servers under both the global [distributedSearch] section and the specific [distributedSearch:HOUSTON] section. The…

Distributed Search

Question

Options

A[distributedSearch]
B[distributedSearch]
C[distributedSearch:NYC]
D[distributedSearch]

How the community answered

(31 responses)

A
3% (1)
B
3% (1)
C
6% (2)
D
87% (27)

Explanation

To run the search sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON, the configuration in the distsearch.conf file must define the servers under both the global [distributedSearch] section and the specific [distributedSearch:HOUSTON] section. The search specifies the use of the field, which refers to the servers in the Houston group. splunk_server_group=HOUSTON The [distributedSearch] section includes all servers (nyc1:8089, nyc2:8089, houston2:8089), and the section houston1:8089, [distributedSearch:HOUSTON] specifically lists the Houston servers (houston1:8089, houston2:8089). This configuration correctly defines the servers for the search.

Topics

#distsearch.conf#Distributed Search#Search Groups#Configuration Stanzas

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice