The customer wants to migrate their current Splunk Index cluster to new hardware to improve indexing and search performance. What is the correct process and procedure for this task?

Question

Options

• A
  1. Install new indexers. 2. Configure indexers into the cluster as peers; ensure they receive the
• B
  1. Install new indexers. 2. Configure indexers into the cluster as peers; ensure they receive the
• C
  1. Install new indexers. 2. Configure indexers into the cluster as peers; ensure they receive the
• D
  1. Install new indexers. 2. Configure indexers into the cluster as peers; ensure they receive the

• A
  28% (7)
• B
  12% (3)
• C
  52% (13)
• D
  8% (2)

Explanation

Note: The answer choices in your question are all truncated at the same point, so I'll explain based on established Splunk indexer cluster migration best practices, which is what this question is testing.

Option C is correct because the proper migration procedure requires adding new indexers as cluster peers, waiting until the cluster reaches a valid (fully replicated) state before taking any action on old hardware, and then formally decommissioning old indexers one at a time using Splunk's decommission process - which safely migrates bucket copies before removing a peer.

The distractors (A, B, D) typically represent common mistakes: removing old indexers before replication is complete (risking data loss), skipping the decommission step and simply removing peers from the configuration (which can break the replication/search factor), or checking for the wrong cluster state (e.g., "searchable" vs. "valid") before proceeding.

Memory tip: Think of it as "add before you subtract, and wait for the green light." New peers come in first → cluster turns green (valid state) → old peers decommission gracefully. Never pull hardware until Splunk has re-homed all primary bucket copies.

No community discussion yet for this question.