To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

Question

Options

• ARolling restart completes.
• BMaster node rejoins the cluster.
• CCaptain joins or rejoins cluster.
• DA peer node joins or rejoins the cluster.

Explanation

Primary rebalancing automatically occurs when a rolling restart completes (A) and when a peer node joins or rejoins the cluster (D). According to Splunk indexer clustering behavior, these two events disrupt the distribution of primary bucket designations across peer nodes, so the cluster master automatically triggers rebalancing to evenly redistribute which bucket copies serve as primaries for search. This ensures search load is spread optimally rather than concentrated on a subset of peers.

Why B is wrong: The cluster master (manager) rejoining does not automatically trigger primary rebalancing - it resumes cluster oversight but delegates rebalancing to the circumstances above.

Why C is wrong: "Captain" is a Search Head Clustering concept (the elected leader of a search head cluster), not an indexer cluster role. It has no bearing on primary bucket distribution.

Memory tip: Think "RP = Restart + Peer" - a Rolling restart completing and a Peer rejoining are the two automatic triggers. Everything else (master, captain) is either the wrong layer of the architecture or doesn't trigger rebalancing on its own.

No community discussion yet for this question.