Which of the following use cases would be made possible by multi-site clustering? (select all that apply)

Question

Options

• AUse blockchain technology to audit search activity from geographically dispersed data centers.
• BEnable a forwarder to send data to multiple indexers.
• CGreatly reduce WAN traffic by preferentially searching assigned site (search affinity).
• DSeamlessly route searches to a redundant site in case of a site failure.

Explanation

Multi-site clustering in Splunk is designed to solve two specific problems: WAN efficiency and geographic redundancy, making C and D the correct answers.

Search affinity (C) is a core multi-site feature - search heads are assigned to a site and preferentially query local indexers, dramatically cutting expensive cross-datacenter WAN traffic. Site failover (D) is the other primary use case - if an entire site goes down, the cluster manager automatically redirects searches to a surviving site, enabling seamless disaster recovery.

Why the distractors are wrong:

• (A) Blockchain has no role in Splunk architecture whatsoever - this is pure noise designed to test whether you'll second-guess yourself.
• (B) Forwarders load-balancing across multiple indexers is a standard single-site capability (configured via outputs.conf) - multi-site clustering is not required for this.

Memory tip: Think of multi-site clustering as solving two "geo problems" - efficiency (keep traffic local = search affinity) and resilience (survive a site loss = failover). If an answer doesn't relate to geography-driven efficiency or redundancy, it's not a multi-site clustering feature.

No community discussion yet for this question.