Buttercup Games has a multi-site indexer cluster. Site 1, which hosts the Cluster Manager, experiences a DNS failure. Site 2 is unable to reach Site 1. What happens to searching at Site 2?

Question

Options

• AThe search heads search data on Site 1 and Site 2.
• BThe cluster continues to function and can still respond to searches.
• CThe cluster stops responding to all searches.
• DThe search heads start locally indexing the data.

• A
  2% (1)
• B
  78% (32)
• C
  7% (3)
• D
  12% (5)

Explanation

Splunk multisite indexer clustering is designed to tolerate temporary network and management- plane failures. The Cluster Manager is responsible for bucket replication coordination, fix-up tasks, and cluster state management, but it is not required for ongoing searching. When Site 2 loses connectivity to Site 1 due to DNS failure, indexers at Site 2 continue to serve searchable buckets they already own. Search heads can still dispatch searches to available indexers and retrieve results from searchable copies that exist locally. Splunk documentation explains that as long as searchable copies are available and indexers are reachable, searching continues normally, even if the Cluster Manager is temporarily unreachable. Only replication management and bucket fix-up operations are paused. The cluster does not stop responding to searches, does not redirect searches to unreachable sites, and search heads never begin indexing data. Therefore, the correct answer is B: The cluster continues to function and respond to searches. Splunk Indexer Clustering Manual; Multisite Cluster Failure Behavior; Cluster Manager Role and

No community discussion yet for this question.