(What are the possible values for the mode attribute in server.conf for a Splunk server in the [clustering] stanza?)

Question

Options

• A[clustering] mode = peer
• B[clustering] mode = searchhead
• C[clustering] mode = deployer
• D[clustering] mode = manager

Explanation

Options A (peer), B (searchhead), and D (manager) are correct. Splunk's [clustering] stanza in server.conf recognizes exactly three role values: peer (an indexer that stores and replicates data), searchhead (a search head participating in an indexer cluster), and manager (the node that orchestrates the indexer cluster, formerly called "master").

Option C (deployer) is wrong because deployer is a Search Head Clustering (SHC) concept, not an indexer clustering role. The deployer pushes apps to search head cluster members and is configured in the [shclustering] stanza, not [clustering].

Memory tip: Think of the [clustering] stanza as governing indexer cluster roles only - the three roles map to the three participants: someone who manages the cluster, someone who stores data (peer), and someone who searches it. The deployer belongs to a different stanza ([shclustering]) for a different cluster type entirely.

No community discussion yet for this question.