A Splunk Index cluster is being installed and the indexers need to be configured with a license master. After the customer provides the name of the license master, what is the next step?

The correct answer is D. Update the Splunk PS base config license app and deploy via the cluster master. Option D is correct because in a Splunk index cluster, configuration changes to indexers should always be distributed through the cluster master using deployment bundles - this ensures consistency across all indexer peers and avoids configuration drift. The Splunk PS base…

Splunk Architecture and Deployment Best Practices

Question

Options

AEnter the license master configuration via Splunk web on each indexer before disabling Splunk
BUpdate /opt/splunk/etc/master-apps/_cluster/default/server.conf on the cluster master and apply a
CUpdate the Splunk PS base config license app and copy to each indexer.
DUpdate the Splunk PS base config license app and deploy via the cluster master.

How the community answered

(19 responses)

A
5% (1)
C
11% (2)
D
84% (16)

Explanation

Option D is correct because in a Splunk index cluster, configuration changes to indexers should always be distributed through the cluster master using deployment bundles - this ensures consistency across all indexer peers and avoids configuration drift. The Splunk PS base config license app is the standard artifact for defining the license master URI, and pushing it via the cluster master's master-apps replication mechanism is the correct, scalable approach.

Why the distractors are wrong:

A is wrong because manually configuring each indexer via Splunk Web is error-prone, doesn't scale, and defeats the purpose of having a cluster master manage peer configuration.
B is wrong because the master-apps/_cluster/default/server.conf path is for cluster-specific settings managed by the cluster master itself, not the license master configuration pushed to indexers - and this option also implies skipping the PS base config app workflow.
C is wrong because manually copying the app to each indexer bypasses the cluster master entirely, creating the same consistency and scalability problems as option A.

Memory tip: In a Splunk index cluster, think "cluster master = traffic cop for indexer configs." Any change that needs to reach all indexers flows through the cluster master - never directly to individual nodes. If an answer involves touching each indexer separately, it's almost certainly wrong.

Topics

#license master#cluster master#PS base config#deployment app

Community Discussion

No community discussion yet for this question.

Full SPLK-3003 Practice