A non-ES customer has a concern about data availability during a disaster recovery event. Which of the following Splunk Validated Architectures (SVAs) would be recommended for that use case?

Question

Options

• ATopology Category Code: M4
• BTopology Category Code: M14
• CTopology Category Code: C13
• DTopology Category Code: C3

• A
  81% (17)
• B
  14% (3)
• C
  5% (1)

Explanation

M4 is the recommended SVA for a non-ES customer needing data availability during a disaster recovery event because it implements a multisite indexer cluster, which replicates data across geographically separated sites - ensuring data remains accessible even if one site fails completely.

M14 is incorrect because that topology is designed for ES (Enterprise Security) customers, not non-ES deployments; the "M" series are multisite architectures but M14 targets a different customer profile with ES requirements.

C3 and C13 are incorrect because "C" topology codes represent single-site clustered architectures - they provide high availability within a single site but lack the cross-site data replication needed to survive a full site-level disaster recovery event.

Memory tip: Think "M = Multisite = More resilient" - the M-series SVAs span multiple physical locations, which is essential for DR. Then remember M4 = non-ES by associating the lower number (4) with a simpler, more common deployment, while higher numbers like M14 add complexity for premium apps like ES.

No community discussion yet for this question.