Which of the following statements describe search head clustering? (Select all that apply.)

Question

Options

• AA deployer is required.
• BAt least three search heads are needed.
• CSearch heads must meet the high-performance reference server requirements.
• DThe deployer must have sufficient CPU and network resources to process service requests and

Explanation

Search head clustering (SHC) in Splunk requires both A and B as correct statements.

A is correct because a deployer is a required, dedicated Splunk instance that pushes app configurations and knowledge objects to all cluster members - without it, there's no centralized way to manage the cluster's configuration.

B is correct because SHC uses a RAFT-based captain election algorithm, which requires a quorum. Three is the minimum member count to achieve a valid quorum and elect a captain; fewer members cannot form a functional cluster.

C is wrong because SHC members must meet standard Splunk reference server requirements, not specifically "high-performance" ones - that designation applies to different deployment scenarios like large indexer tiers.

D is wrong (as written) because the deployer's sole role is distributing configurations to cluster members - it does not process user search requests or handle search service traffic. That work is handled by the search heads themselves.

Memory tip: Think of the deployer as a "silent postmaster" - it only delivers config packages to the cluster, never answers search queries. And remember the number 3 as the magic minimum: like a three-legged stool, SHC needs three members to stand upright and elect a captain.

No community discussion yet for this question.