Which Splunk component performs indexing and responds to search requests from the search head?

Question

Options

• AForwarder
• BSearch peer
• CLicense master
• DSearch head cluster

• A
  4% (1)
• B
  88% (21)
• D
  8% (2)

Explanation

A search peer (B), also commonly called an indexer, is the Splunk component that performs two key functions: it indexes incoming data (parsing, transforming, and writing events to disk in buckets), and it responds to search requests distributed by the search head. In a distributed Splunk deployment, the search head coordinates searches by sending requests to one or more search peers, which execute the search against their local indexes and return results. 'Search peer' specifically refers to an indexer in the context of its relationship to the search head. Forwarders (A) collect and forward data but don't index. The license master (C) manages licensing. A search head cluster (D) is a group of search heads, not indexers.

No community discussion yet for this question.