Which of the following Splunk deployments has the recommended minimum components for a high- availability search head cluster?

Question

Options

• A2 search heads, 1 deployer, 2 indexers
• B3 search heads, 1 deployer, 3 indexers
• C1 search head, 1 deployer, 3 indexers
• D2 search heads, 1 deployer, 3 indexers

• A
  4% (2)
• B
  94% (50)
• C
  2% (1)

Explanation

The correct Splunk deployment to have the recommended minimum components for a high- availability search head cluster is 3 search heads, 1 deployer, 3 indexers. This configuration ensures that the search head cluster has at least three members, which is the minimum number required for a quorum and failover1. The deployer is a separate instance that manages the configuration updates for the search head cluster2. The indexers are the nodes that store and index the data, and having at least three of them provides redundancy and load balancing3. The other options are not recommended, as they either have less than three search heads or less than three indexers, which reduces the availability and reliability of the cluster. Therefore, option B is the correct answer, and options A, C, and D are incorrect. 1: About search head clusters 2: Use the deployer to distribute apps and configuration updates 3: About indexer clusters and index replication

No community discussion yet for this question.