How does Monitoring Console (MC) initially identify the server role(s) of a new Splunk Instance?

Question

Options

• AThe MC uses a REST endpoint to query the server.
• BRoles are manually assigned within the MC.
• CRoles are read from distsearch.conf.
• DThe MC assigns all possible roles by default.

• A
  93% (25)
• C
  4% (1)
• D
  4% (1)

Explanation

When a new Splunk instance is added to Monitoring Console, MC automatically discovers its role(s) by querying the instance via a REST endpoint (/services/server/info), which returns metadata including the instance's configured roles - no manual intervention required for initial detection.

Why the distractors are wrong:

• B is incorrect because role assignment in MC is automatic on discovery, not a manual step (though you can customize roles afterward).
• C is incorrect because distsearch.conf governs distributed search peer configuration, not the mechanism MC uses to identify roles.
• D is incorrect because MC doesn't blindly assign all roles - it actively queries and reflects the actual roles the instance reports.

Memory tip: Think of MC as a "phone call" - when a new instance joins, MC calls it (REST query) and asks "what are you?" rather than guessing or waiting for someone to fill out paperwork.

No community discussion yet for this question.