SPLK-2002(205Q) · Question #54
A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf: [clustering] mode = master replication_factor = 2 pass4SymmKey = password123 Which of the following…
B is correct because the search_factor is not explicitly defined in this config, and Splunk's default search_factor is 2, meaning at least 2 searchable copies of bucket data are maintained across the cluster - this default applies automatically without needing to be declared. D…
Question
A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:
[clustering] mode = master replication_factor = 2 pass4SymmKey = password123 Which of the following statements describe this Splunk instance? (Select all that apply.)
Options
- BThis cluster's search factor is 2.
- CThis Splunk instance needs to be restarted.
- DThis instance is missing the master_uri attribute.
Explanation
B is correct because the search_factor is not explicitly defined in this config, and Splunk's default search_factor is 2, meaning at least 2 searchable copies of bucket data are maintained across the cluster - this default applies automatically without needing to be declared.
D is wrong because master_uri is only required for slave (peer) nodes and search heads that need to locate the master. Since mode = master, this instance IS the master - it does not point to itself.
C is a distractor - while configuration changes to server.conf generally require a restart to take effect, the question only shows the current config state, not whether a change was just made. You cannot conclude a restart is needed solely from reading the file.
Memory tip: Think of the master as the "boss" - bosses don't need someone's address to find themselves (master_uri), and if no search_factor is set, Splunk defaults to 2 = replication_factor (when RF=2, SF also defaults to 2, but SF can never exceed RF).
Topics
Community Discussion
No community discussion yet for this question.