A working search head cluster has been set up and used for 6 months with just the native/local Splunk user authentication method. In order to integrate the search heads with an external Active…

Question

Options

• AConfigure the integration in a base configuration app located in shcluster-apps directory on the
• BLog onto each search using a command line utility. Modify the authentication.conf and
• CConfigure the LDAP integration on one Search Head using the Settings > Access Controls >
• DOn each search head, login and configure the LDAP integration using the Settings > Access

• A
  62% (16)
• B
  23% (6)
• C
  8% (2)
• D
  8% (2)

Explanation

In a Splunk Search Head Cluster (SHC), all configuration changes must be distributed through the deployer by placing them in a configuration app within the shcluster/apps directory and pushing to cluster members - this ensures every search head receives an identical, consistent configuration, which is Option A.

Why the distractors fail:

• B is wrong because manually editing authentication.conf via CLI on individual search heads creates configuration drift and breaks the managed-cluster model.
• C is wrong because authentication.conf is not part of the SHC's automatic knowledge bundle replication - changes made via the GUI on one search head will not propagate to the others.
• D is wrong for the same reason as C, plus manually repeating the GUI process on every node is error-prone and unscalable.

Memory tip: Think of the SHC deployer as the "single source of truth" - any configuration that needs to live on all search heads must flow through the deployer's shcluster/apps path, never be set directly on individual members. If you find yourself logging into search heads one by one to make changes, you're doing it wrong.

No community discussion yet for this question.