Question 1

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

Options :

A : Disables search site affinity.

B : Sets all members to dynamic captaincy.

C : Enables multisite search artifact replication.

D : Enables automatic search site affinity discovery.

Answer: A

Question 2

The frequency in which a deployment client contacts the deployment server is controlled by what?

Options :

A : polling_interval attribute in outputs.conf

B : phoneHomeIntervalInSecs attribute in outputs.conf

C : polling_interval attribute in deploymentclient.conf

D : phoneHomeIntervalInSecs attribute in deploymentclient.conf

Answer: D

Question 3

Configurations from the deployer are merged into which location on the search head cluster member?

Options :

A : SPLUNK_HOME/etc/system/local

B : SPLUNK_HOME/etc/apps/APP_HOME/local

C : SPLUNK_HOME/etc/apps/search/default

D : SPLUNK_HOME/etc/apps/APP_HOME/default

Answer: A

Question 4

To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

Options :

A : Rolling restart completes.

B : Master node rejoins the cluster.

C : Captain joins or rejoins cluster.

D : A peer node joins or rejoins the cluster.

Answer: A,B,D

Question 5

What is the expected minimum amount of storage required for data across an indexer cluster with the

following input and parameters?

• Raw data = 15 GB per day

• Index files = 35 GB per day

• Replication Factor (RF) = 2

• Search Factor (SF) = 2

Options :

A : 85 GB per day

B : 50 GB per day

C : 100 GB per day

D : 65 GB per day

Answer: C