Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

Question

Options

• AIs the job scheduler for the entire SHC.
• BManages alert action suppressions (throttling).
• CSynchronizes the member list with the KV store primary.
• DReplicates the SHC's knowledge bundle to the search peers.

Explanation

The correct answers are A, B, and D. The SHC captain acts as the cluster's job scheduler, dispatching scheduled searches and reports across all members (A). It also manages alert action suppression - ensuring that throttled alerts don't fire multiple times across members simultaneously (B). Additionally, the captain is responsible for replicating the SHC's knowledge bundle out to the search peers (indexers), so all members present a consistent search-time configuration (D).

Why C is wrong: Synchronizing the member list with the KV store primary is not a captain responsibility. The KV store maintains its own independent replication topology with its own elected primary; the SHC captain does not coordinate that process.

Memory tip: Think of the captain as the cluster's coordinator of outward-facing tasks - scheduling work (A), suppressing duplicate alerts (B), and pushing knowledge to indexers (D). KV store replication is a separate internal subsystem the captain doesn't drive.

No community discussion yet for this question.