A customer has a Search Head Cluster (SHC) with site1 and site2. Site1 has five search heads and Site2 has four. Site1 search heads are preferred captains. What action should be taken on Site2 in a…

Question

Options

• ADisable elections and set a static captain, then restart the cluster.
• BNo action is required.
• CSet a dynamic captain manually and restart.
• DDisable elections and set a static captain, notifying all members.

• A
  23% (8)
• B
  60% (21)
• C
  6% (2)
• D
  11% (4)

Explanation

Splunk's Search Head Clustering documentation explains that the cluster uses a majority-based election system. A captain is elected only when a node sees more than half of the cluster. In a two- site design where site1 has the majority of members, Splunk states that the majority site continues normal operation during a network partition. The minority site (site2) is not allowed to elect a captain and should not promote itself. Splunk specifically warns administrators not to enable static captain on a minority site during a network split. Doing so creates two independent clusters, leading to configuration divergence and severe data-consistency issues. The documentation emphasizes that static captain should only be used for a complete loss of majority, not for a site partition. Because Site1 maintains majority, it remains the active cluster and site2 does not perform any actions. Splunk states that minority-site members should simply wait until network communication is Thus the correct answer is B: No action is required. Splunk Search Head Clustering Manual (Captain Election Behavior, Static Captain Warnings, Site Partition Behavior).

No community discussion yet for this question.