A customer has asked for a five-node search head cluster (SHC), but does not have the storage budget to use a replication factor greater than 2. They would like to understand what might happen in…

Question

Options

• AThe search head that the user has logged onto will proxy the required artifact over to itself from a
• BBecause the dispatch folder containing the search results is not present on the search head, the
• CThe user will not be able to see the results of the search until one of the search heads is restarted,
• DThe user will not be able to see the results of the search until the Splunk administrator issues the

• A
  63% (22)
• B
  6% (2)
• C
  11% (4)
• D
  20% (7)

Explanation

Option A is correct because Splunk Search Head Clusters are designed to handle exactly this scenario through artifact proxying - when a user lands on a search head that does not locally hold a copy of a scheduled search's dispatch folder, that node automatically fetches (proxies) the artifact from a peer cluster member that does have it, making the results transparently available to the user without any manual intervention.

Option B is wrong because it assumes the absence of a local dispatch folder is a dead end; it ignores the SHC's built-in proxying capability that was purpose-built for replication factor constraints like RF=2 in a 5-node cluster.

Options C and D are wrong because they introduce unnecessary manual or administrative steps (restart, admin command) - SHC artifact proxying is automatic and requires no operator action; describing it otherwise would make SHC operationally impractical.

Memory tip: Think of SHC proxying like a library's inter-branch loan system - if your local branch (search head) doesn't have the book (artifact), it automatically borrows it from another branch rather than telling you it's unavailable.

No community discussion yet for this question.