(Which command is used to initially add a search head to a single-site indexer cluster?)

Question

Options

• Asplunk edit cluster-config -mode searchhead -manager_uri https://10.0.0.1:8089 -secret
• Bsplunk edit cluster-config -mode peer -manager_uri https://10.0.0.1:8089 -secret changeme
• Csplunk add cluster-manager -manager_uri https://10.0.0.1:8089 -secret changeme
• Dsplunk add cluster-manager -mode searchhead -manager_uri https://10.0.0.1:8089 -secret

• A
  93% (26)
• C
  4% (1)
• D
  4% (1)

Explanation

According to Splunk Enterprise Distributed Clustering documentation, when you add a search head to an indexer cluster, you must configure it to communicate with the Cluster Manager (previously known as Master Node). The proper way to initialize this connection is by editing the cluster The correct syntax for a search head is: splunk edit cluster-config -mode searchhead -manager_uri https://<manager_host>:8089 -secret -mode searchhead specifies that this node will function as a search head that participates in distributed search across the indexer cluster. -manager_uri provides the management URI of the cluster manager. -secret defines the shared secret key used for secure communication between the manager and cluster members. Once this configuration is applied, the search head must be restarted for the changes to take effect. Using -mode peer (Option B) is for indexers joining the cluster, not search heads. The add cluster- manager command (Options C and D) is not a valid Splunk command. - Configure the Search Head for an Indexer Cluster - Indexer Clustering: Configure the Cluster Manager, Peer, and Search Head Nodes - Splunk Enterprise Admin Manual: splunk edit cluster-config Command Reference

No community discussion yet for this question.